# Database and data security

* Use parameterized queries or ORM parameter binding; never concatenate untrusted input into SQL.
* Use least-privilege database accounts and protect connection strings.
* Scope tenant-owned queries explicitly and prevent cross-tenant cache, logging, and diagnostic leakage.
* Collect and retain only necessary sensitive data; encrypt it in transit and at rest where appropriate.
* Avoid raw database errors and use transactions where integrity requires atomicity.