Security Best Practices

Key management

• Use one API key per environment (dev, staging, prod)

• Rotate keys periodically

• Revoke unused or compromised keys immediately

Secret handling

• Store keys in a secrets manager or secure environment variables

• Never hardcode keys in source code

• Never expose API keys in browser/mobile client bundles

Access control

• Call Veilio from your backend only

• Restrict detokenization routes to authorized users/services

• Require business reason on detokenization actions

Reliability and abuse protection

• Implement retries with backoff for 429

• Add alerts for repeated 401, 403, and 5xx

• Monitor request volumes by integration and environment

Data handling

• Store tokens by default, not raw PII

• Detokenize only at the last possible moment in a workflow

• Avoid writing detokenized values to logs

If you have any issues or suggestions, feel free to reach out to us here: https://veilio.xyz/contact