> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.duuo.cooperators.ca/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.duuo.cooperators.ca/_mcp/server.

# Security & Privacy

The Prefill API handles personally identifiable information (PII) — including customer names, dates of birth, contact details, home addresses, and vehicle identification numbers. *Both Co‑operators and partner have responsibilities regarding the protection of data - please see your partner agreement for more details.*

## Authentication & Transport

All requests must be made over HTTPS/TLS. HTTP connections are rejected. The OAuth 2.0 client credentials flow ensures that only credentialed partners can submit prefill data. Additional platform-level safeguards include IP allow-listing, strict schema validation, rate limiting, and audit logging.

## Partner Isolation

Each prefill record is bound to the `producerCode` of the partner that created it. When a customer’s journey launches, Co‑operators verifies that the `recordId` being accessed matches the `producerCode` in context. If there is a mismatch, the request is denied and logged. No prefill data is returned, and the error response does not reveal whether the record exists or who owns it. This prevents cross-partner data exposure.

## Partner Responsibilities

As the party initiating the data transfer, your organization is responsible for:

Customer consent: Collecting and maintaining valid customer consent to share their data with Co‑operators before making a Prefill API call. *Please consult with your own legal advisors regarding your compliance with applicable laws related to privacy and your handling of personal information. A compliance review of your implementation with your Account Manager will be required prior to going live. Any changes to consent language after launch require review prior to deployment.*

Credential security: Storing `client_id` and `client_secret` securely in server-side credential management systems (e.g. a secrets manager). Never exposing credentials in client-side code, browser requests, URL parameters, or log output.

Data minimization: Submitting only the data fields required for the customer’s specific quote journey. Do not send additional PII beyond what is listed in the Field Definitions section.

Secure transmission: Ensuring all API calls originate from your secure backend infrastructure, not from browser or mobile client environments.

## Co‑operators Responsibilities

* API transmission, storage, and retrieval adhere to Co‑operators data protection standards

* Logs do not contain raw PII — sensitive fields are masked or excluded from all log output

* Least-privilege access controls apply to any internal views or tooling that expose prefill records

* Prefill records are automatically purged after their TTL expires

## Data Retention & Lifecycle

Prefill records are stored in a Temporary Prefill Data Model with a time-bound TTL (default: 1 day). After the TTL expires, the record is automatically purged and all associated PII is deleted. If the customer attempts to use an expired redirect URL, the journey falls back gracefully to the standard non-prefill flow — no error is shown to the customer. Partners should account for TTL expiry when designing their redirect flow, particularly for email campaigns with delayed opens.