Auth Privacy And Governance

Integrator wires the Reducto API key into a browser-side script so the frontend can call the parse API directly.

Keep the API key server-side only; never ship it in a browser bundle or mobile app where it can be extracted. Front document submission through the operator's backend which holds the key. Scope and rotate keys per the documented key model. Treat fine-grained key scoping support as [REQUIRES-VERIFIC…

Operator must guarantee customer documents are never used to train shared models. The integrator never checks Reducto's data-usage terms and asserts the guarantee to its own customers.

Verify the processor's documented data-usage / model-training terms (whether submitted content is used for training, and any opt-out) BEFORE asserting a no-training guarantee downstream. Pin the contractual terms, not a memory of a marketing claim. Treat the current data-usage policy as [REQUIRES-V…

Submitted documents contain SSNs, account numbers, and health data. The integrator submits them with no awareness of how long Reducto retains uploads or outputs.

Treat document content as sensitive: confirm the documented upload/output retention and deletion controls, minimize what is sent (redact unneeded identifiers pre-submit where feasible), and verify retention meets the operator's data-handling obligations before sending regulated data. Treat exact re…