> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getmillwork.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Data and credentials

> Know what you may send, where credentials belong, and what receipts contain.

Your app uses a Millwork API key. Provider credentials use a separate secure
connection. Receipts do not contain prompts or model output.

## Where credentials belong

| Item                 | Purpose                                | Never use it as                    |
| -------------------- | -------------------------------------- | ---------------------------------- |
| Browser session      | Human dashboard access                 | An application credential          |
| Organization API key | Application access to one organization | A provider credential              |
| Provider connection  | Protected access to a provider account | A registered option or run request |
| Receipt              | Record of how a run was handled        | The model output                   |

## What you may send

Use only public information or test data created for the evaluation. Do not send
confidential company information, customer data, personal data, secrets, or
regulated data.

For model runs in private preview, set `data_classes` to `public` for public
information. Use `sandbox` for examples you invented for testing. It provides
no additional privacy or isolation. Requests using `tenant_internal` are rejected.

## What Millwork keeps out of responses

* raw provider credentials or internal credential handles;
* another organization’s existence, members, or connections;
* internal accounts used for model access provided by Millwork;
* raw provider failure bodies;
* prompt or result content inside a receipt.

## Team access

Use the smallest role needed for each person.

| Role          | Main access                                     |
| ------------- | ----------------------------------------------- |
| Owner         | Organization, members, keys, usage, and billing |
| Admin         | Members except owners, settings, keys, and runs |
| Developer     | Keys, runs, models, and output checks           |
| Billing admin | Billing, usage, and run visibility              |
| Viewer        | Read-only usage and run visibility              |

A role change or member removal takes effect at the person's next sign-in. An
existing browser session keeps its previous role. Ask the person to sign out
and sign in again before relying on the new access. If a human account may be
compromised, [email support](mailto:support@getmillwork.dev) immediately.

## If a credential may be exposed

Revoke the affected organization API key or provider connection and stop new
runs. Then [email Millwork support](mailto:support@getmillwork.dev). Do not
include any secret in the message.