Go-live Checklist

Environment and secrets

• Separate API keys for dev/staging/prod
• Standard keys for runtime; MIGRATION keys only for historical import
• All keys stored in secure environment variables or secret manager
• No secrets committed to code repository

Integration quality

• Tokenize on write paths validated
• entityId set for profile grouping where needed
• Detokenize only in approved workflows
• reason provided for detokenization calls
• Bulk endpoints used for high-volume operations

Legacy data migration

• Migration mode activated and budget sized for export cell count
• veilio-migrate.mjs tested on sample CSV with --dry-run
• Checkpoint/resume tested (--resume) for large files
• Migration key rotated or revoked after import completes

Organizations (if team sharing)

• Organization created before owner Stripe subscription (Pro+ for 2+ people)
• Column policies defined per dataset
• VIEWER whitelist reviewed if using invite-only read access

Reliability

• Retry strategy implemented for 429 and transient 5xx
• Monitoring and alerts on error rates
• Integration load tests completed (see Performance; measure from your region)

Security and operations

• API key rotation process documented
• Incident response runbook created
• Access permissions reviewed (least privilege)
• Shred strategy defined (per-token, bulk, entityId profile)
• Dataset public share link TTL policy reviewed
• Offboarding path documented (export data + logs before delete)

Business readiness

• Support team trained on token-based workflows
• Compliance stakeholders validated process
• Rollback plan documented
• Billing model confirmed (Stripe self-service vs Enterprise invoice)