How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Secure Prompt & Context Management
Encrypt prompts and responses
Verify that prompts and AI responses are encrypted in transit and at rest, and retained per the data-classification policy. Tenants and projects are cryptographically separated from each other.
OWASP AISVS v1.01, requirement AC.3.6
In plain English
Encrypt prompts and responses in transit and at rest, keep them only as long as their data classification allows, and separate tenants and projects cryptographically.
What good looks like
- Encryption in transit and at rest is on.
- Retention follows the data classification policy.
- Each tenant or project has separate keys.
How teams usually do it
- Vendor enterprise settings for retention and encryption, plus customer-managed keys where offered.
Evidence an auditor would accept
- Vendor configuration and retention settings.
Common mistakes
- Default retention settings that keep prompts indefinitely.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.