Here is the honest situation. Here is the honest situation. Model provider integrations rarely fail security review because somebody wrote insecure code. They fail because the boundary was never treated as a boundary. The first failure is the surface itself. Ask an organization what it integrates with and you get one endpoint, the one in the architecture diagram, the one the main application calls. The actual surface is a set: inference endpoints, several model versions, tool and function calling paths, file upload routes that carry whatever a user attached, batch interfaces, embedding and retrieval services, evaluation consoles, and an administrative portal where a human being can read stored conversations belonging to any project on the account. The assessment on file examined one of those. The second failure is the arrow on the diagram. The provider appears as a single line leaving the drawing, which quietly asserts that everything past it belongs to someone else. It does not, because the organization stays accountable for the data it sent. So the threats specific to this boundary are never enumerated: content leaving on a path never designed to carry it, responses assembled from material the caller was not entitled to, state persisting longer than anybody believes, humans reading stored content through support paths, and behaviour changing under a stable identifier. None of those appear in a vendor review template built for a hosting supplier. The third failure is that nobody can say what actually leaves. Teams describe the user prompt. They forget that the prompt carries retrieved context assembled at runtime from internal sources, that the system instruction carries proprietary process detail, that tool call arguments carry record identifiers and record contents, and that uploaded files carry whatever a user chose to attach. Classification stops at the application's own data model and never follows the data across. The fourth failure is where the answers come from. The training-use position, which is the first question every customer and every regulator asks, is usually sourced from a public page rather than from the terms that bind the account, and those differ by product tier, by interface, by region and by whether a particular setting is switched on. The retention answer is worse, because it is normally a single number copied from a summary while request content, uploaded files, conversation state, index artefacts and operational logs sit on entirely different schedules. Then a customer asks about one category on one path and the answer has to be reconstructed from an integration diagram during the week it is due. The fifth failure is that isolation is accepted rather than tested. An assurance report is read, the isolation claim is believed, the integration ships. Nobody submits marked content under one session and then goes looking for it from another, under another credential, in another region, with the exact feature set production runs. So when a customer asks whether their data can surface in another customer's output, the organization repeats the provider's claim and has nothing of its own to point at. The sixth failure is the artefacts that outlive the request. Caching is enabled as a performance setting, and the cached object is usually the system instruction and the retrieved context rather than the short question, so the most carefully handled material is the part that got stored. Embeddings, indexes, shared instruction layers and tuning outputs accumulate as durable derivatives of source data, are read by requests other than the one that created them, and are treated as infrastructure rather than as copies. Deleting the source record does not touch the vector derived from it. The seventh failure is state. The provider offers to hold conversations, threads and files, and it is a real convenience, so the choice gets made in a sprint by whoever is writing the client. It is the one architectural decision at this boundary that everything else inherits: residency, retention, deletion, who can see it, whether it can be placed under a legal hold, what happens during a disclosure request. Alongside it sits an assumption that the provider console is the audit trail. It is a product feature, and it can be truncated, expired or changed without notice, so the organization that most needs to prove what it sent has outsourced the proof. The eighth failure is identity. One key, created during the first experiment, pasted into whatever needed it. Production and staging share it. Three services share it. A laptop has it. Attribution is impossible and revocation is an outage nobody can scope, so a leaked credential cannot be contained without stopping everything. Rotation has never been performed, which is why it is feared. Meanwhile the organization's own multi tenant code assembles prompts at runtime from retrieved context, history, tool results and shared instructions, and any one of those assembly points can include the wrong tenant's material through a scoping bug, a loosely keyed cache or a background job running with no user context. The provider will faithfully answer the request it was given, and the boundary that failed will have been yours. The ninth failure is the contract. Nearly everything the organization tells its customers rests on properties of the provider, and those properties are quoted from documentation the provider can change unilaterally rather than from clauses somebody owes. Assurance evidence is collected, dated and filed, which detects an expired report and nothing else, because nobody checks whether its scope covers the interfaces and regions actually used. And exit is a commercial question for later, so prompts, instruction layers, evaluation sets and derived artefacts accumulate only inside the provider until leaving becomes a project nobody has budget for. Where teams fall short is predictable: one endpoint assessed out of a dozen, the provider as an arrow, retrieved context unclassified, a retention figure that describes the wrong path, an isolation claim never probed, a cache holding the material you were most careful about, embeddings that survive the deletion of their source, conversation state in a region nobody chose, the provider console standing in for an audit trail, one shared key, tenancy filtered at the user interface and inferred everywhere after it, customer commitments with no clause behind them, and an exit cost nobody has ever estimated.
This Kit removes the guesswork. It is third-party model provider API security written as adopt-ready controls you personalize in a weekend, with the evidence a security architecture board, a customer security reviewer, an auditor or a regulator actually examines.
What you get, the moment you buy
Grounded in enterprise security architecture and third-party integration practice as it is actually run inside organizations buying model provider capability under real customer and regulatory scrutiny. Editable Word and Excel files. This is a practitioner method and it is honest about what you can verify yourself and what you can only contract for.
What one control looks like
This is the opening control, where the whole assessment either covers the boundary you actually run or covers the one endpoint somebody drew. All 18 are built to this depth.
Why this is not another template pack
- The evidence is the point. A reference architecture and a set of principles are not evidence. This tells you what a security architecture board, a customer security reviewer, an auditor or a regulator examines and where teams fall short, for every control.
- The hard specifics built in. A register covering every endpoint, model version, upload route, batch interface, console and administrative portal reconciled against provider usage records, a boundary threat model with each threat accepted, mitigated or transferred by a named person, change tracked to an owned mailbox with pinned versions and a re-run behavioural baseline, a data flow map verified against sampled real traffic including retrieved context and tool call arguments, a training-use position taken from the binding terms per interface and tier with the enforcing setting verified, retention, residency and deletion recorded per category with the objects the provider keeps regardless listed explicitly, a cross-tenant test set run with marked canary content and re-run after every change, caching recorded as a data sharing decision with key granularity and reader scope, embeddings, indexes, instruction layers and tuning outputs inventoried as derivatives that inherit their source classification, the server side against client side state decision approved by name with its consequences written down, an authoritative audit record on your own systems searchable by tenancy, identity and time, a deletion procedure enumerating every copy and exercised end to end, one credential per workload with administrative capability separated and rotation exercised on schedule, tenancy enforcement immediately before dispatch failing closed with tests in the build pipeline, relied upon properties as express contractual obligations traced to every customer commitment, assurance evidence read against your own dependency list, and an exit position naming what is exportable, rebuildable or lost are written into the controls, not left generic.
- Built on real practice, not one person's opinion, grounded in how model provider integrations actually hold together under enterprise scrutiny and where that discipline usually breaks down.
- It compounds. This work shares its shape with third-party risk management, data protection, security architecture review and vendor contracting, so it feeds your wider assurance operating model.
Who buys this
Enterprise architects, security engineers, security architects, application security leads, and the technology risk officers accountable for evaluating, integrating and contracting for third-party model provider APIs in production systems, who have to say what leaves the boundary, whether submitted content can be used for training, how long it is retained and where, whether one customer's content can reach another customer's response, who at the provider can read stored conversations, what a deletion request actually removes, which credential a call came from, and which clause supports the promise already given to a customer. Whether you are running the first security review of a provider your product teams have already integrated, or rebuilding an integration that could not answer a customer questionnaire, you save weeks and walk in with your surface, data, leakage, state, identity and contractual controls structured.
Common questions
Is it really editable? Yes. Word and Excel files you own and adapt. No portal, no subscription.
Does it cover the whole practice? Yes. Provider API surface assessment and boundary threat modelling, data flow, retention, residency and training-use position, cross-session, cross-tenant and caching leakage exposure, state management architecture, audit and deletion consequences, identity, key management and tenancy isolation at the integration, and contractual security requirements, assurance evidence and exit each have their own controls with their own evidence.
Is this tied to one provider, one model or one integration pattern? No. The controls are principle-level, the surface register, the boundary threat model, the data flow and retention discipline, the leakage test method, the state decision, the credential and tenancy rules and the contracting position, so they apply whichever provider you buy from and however you call it.
Is this a prompt injection or application security course? No, and that is deliberate. This is about the provider boundary itself: what the API exposes, what leaves, what is retained and where, who can be served from a shared artefact, and what your agreement obliges. Application hardening is a separate discipline and it does not answer any of those questions.
What if it is not for me? A 30-day money-back guarantee.
Instant digital download · 30-day money-back guarantee · The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001 · support@theartofservice.com