Standards

Security

Dedicated security and privacy normative guides are planned (SEC-001, SEC-002). v0.1 implementers should follow these baseline practices today.

Data minimization

• Emit only fields required by OGIS; avoid embedding account emails or names in raw_event_id
• Keep vendor credentials and session tokens out of canonical events and logs
• Use stable opaque subject_id values scoped to your application

Transport and storage

• Encrypt glucose data in transit (TLS) and at rest in your application policy
• Authenticate adapter and API endpoints; OGT core does not replace your app’s auth model
• Audit access to glucose streams in clinical or research deployments