Protect the key. Rotate on leak. Verify signed payloads when we ship them.

• Secret API key stored in an environment variable — never committed to git
• Publishable key used only in client-side code; secret key used only server-side
• Key-rotation plan documented (how your team rotates if a key leaks)
• Webhook signature verification implemented (for when we ship signed webhooks)

429s happen. Back off. Show users the path to more capacity.

• 429 response triggers exponential backoff (min 1s, cap 60s)
• Retry-After header honored
• Monthly quota exhaustion triggers a user-facing "upgrade" CTA, not a silent failure
• X-Monthly-Quota-Remaining surfaced somewhere users can see

Retry 5xx, surface 4xx, log request IDs, and never trust a 200 without checking success.

• 5xx responses retried (idempotent requests only) with backoff
• 4xx responses surface errors[0].message to internal logs
• request_id logged on every API call for cross-referencing with HempData support
• Critical business logic NEVER trusts a 200 response without checking success === true

Compliance calls are evidence. Keep the citations, keep the timestamps, show the disclaimer.

• Confidence scores < 0.6 surface to your compliance review queue, not your customer
• sources[] citations stored alongside your scan result for audit trail
• last_verified timestamps checked against your refresh cadence
• Disclaimer ("not legal advice") visible in your UI wherever HempData results are shown

Know when we break. Have an answer for H.R. 5371 change alerts.

• /v1/status monitored (page on-call if components.database is not healthy)
• Your team subscribed to the HempData changelog (when published)
• Support contact saved: support@hempdata.io
• Incident response plan for an H.R. 5371 regulation change (when we push a regulation update via webhook, what do you do?)

Document HempData as a subprocessor. Sign a DPA when we ship one. Retain only what you need.

• Your privacy policy discloses HempData as a subprocessor for compliance data
• DPA signed (when we ship one, expected Q2)
• End-user data transmission (if any) minimized — only what is needed for the compliance check
• Data retention policy matches HempData’s (we retain usage logs 90d; you should document your retention for HempData-derived data)