---
title: Security checklist - design phase
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## Business and compliance requirements

- Define security classification and compliance needs (e.g., GDPR, ISO 27001, SOC 2).
- Document data residency, retention, and privacy policies.
- Include security goals and acceptance criteria in scope and user stories.
- Create an architecture overview showing security-critical components and data flows (roles, personal data, AI/ML, third-party services, etc.).
- Perform threat modeling to identify and mitigate risks.
- Estimate user count, roles, and access restrictions for the Xperience administration interface.
- Allocate resources for security testing, code review, and secure deployment.

## Environment security considerations

- Confirm which deployment environment best fits your business requirements (self-hosted, [private cloud](https://docs.kentico.com/documentation/developers-and-admins/deployment/deploy-to-private-cloud.md), [SaaS](https://docs.kentico.com/documentation/developers-and-admins/saas.md)).
- Review available security controls for your environment (secrets management, WAF, network isolation, configuration, etc.).

## Xperience by Kentico security specifications

- Map your security requirements to available Xperience features.
- Review the [security guidelines](https://docs.kentico.com/documentation/developers-and-admins/security-guidelines.md) for Xperience and plan your implementation accordingly.
- Validate your third-party integrations and confirm they meet the required security standards for your environment.
- Consider the integration of AI features like [AIRA](https://docs.kentico.com/documentation/business-users/aira.md) and confirm they meet the required security standards for your project and environment.
- Design authentication and authorization aligned with the least-privilege principle.