Access and tenant isolation
Production roles must restrict access by organisation and function. Sensitive diagnostic tools and supplier actions require tenant scoping, authentication, authorisation and immutable audit trails.
Data safeguards
Use TLS for data in transit, encryption for sensitive data at rest where appropriate, secure secret storage, periodic credential rotation, backups and documented recovery exercises.
Secure development
Maintain dependency review, code scanning, protected deployment pipelines, staging environments, configuration management and systematic security tests. Privileged operations require review and accountability.
AI support safeguards
AI diagnosis must be grounded in authorised account records and audit results, isolate customer data, limit returned personal details and use allow-listed, reversible remediation actions when possible. Uncertain or impactful changes require independent confirmation or escalation.
Compliance
Requirements include GDPR/data protection, applicable telecoms and consumer obligations, payment service provider requirements and supplier contracts. Final compliance statements depend on entity, operating country and actual deployed controls.