Security & Compliance

ICDC is designed to minimize data handling risk while enabling access to commercial data.

Zero‑copy

• Data remains at the vendor. ICDC proxies requests without persisting payloads.
• Auth translation happens server‑side; vendor secrets are never shared with clients.

Access control

• Organization‑based RBAC with scoped tokens per data source.
• Approvals and revocations are enforced at the proxy.

Audit & compliance

• Requests and errors are logged for audit.
• Usage reporting supports governance and billing.

Best practices for clients

• Store tokens in secure secret managers; rotate on personnel or environment changes.
• Prefer server‑side usage of tokens; avoid embedding in public/front‑end apps.