MANSOQ Knowledge
← Knowledge library

Security & governance

Protect credentials, patient payloads and private evidence

Keep operational secrets and clinical material out of public knowledge content and exports.

Current source · source reviewed · 5 min read

Before you begin

1. Store credential references

Integration settings should reference approved secret-manager entries. Do not place private keys, tokens or secret values into user-visible fields, training screenshots or public documents.

2. Inspect exports before release

Use the supported guarded export path and retain only public-safe configuration metadata. An integration export is not permission to publish the underlying certificate or credential material.

3. Reference protected payloads

Logs, reports and support notes should carry transaction identifiers or protected pointers instead of inlining patient requests, responses or attachments.

4. Verify screenshot safety

Capture only an authorized synthetic training environment. Remove names, IDs, contact details, clinical facts, tokens and private commercial documents before publishing a learning asset.

Source controls present

The source-evidence API uses facility-scoped private documents and short-lived download links. RCM reports avoid reading raw payload and endpoint secret-reference fields for output.

Rotation and review

Certificate rotation is a controlled integration operation. Review certificate metadata and expiry without disclosing the private key; confirm that production and test references remain separate.

Troubleshooting

A key or patient value appears in a screen intended for publication

Stop publication of that asset, replace it with a sanitized synthetic capture and route the exposure to the responsible security owner.

Source evidence

References are pinned to the private MANSOQ source repository. Repository access is required to open these links.