---
title: "Backend and data profile"
---

> Documentation Index
> Fetch the complete documentation index at: https://nclsppr.github.io/project-foundation/llms.txt
> Use this file to discover all available pages before exploring further.

# Backend and data profile

Activate this profile for an API, service, database, payment, or external integration.

This profile implements `P03`, `P04`, `P09`, `P10`, `P11`, `P13`, `P14`, and `P21`.

## Contract

- Identify one canonical contract: OpenAPI specification, schema, events, or versioned interface.
- Update the contract before or with the implementation.
- Generate clients and artifacts from this source.
- Detect incompatibilities before delivery.
- Document error codes and authorization rules.

## Data

- Use versioned migrations. Do not use untracked manual DDL.
- Back up data before a high-risk migration.
- Test the migration on a representative state.
- Define an explicit rollback or correction strategy.
- Test restore to an isolated target. Never restore to the production system that serves users.
- Document retention and deletion.
- Make identifiers and constraints consistent with business invariants.

## Concurrency and recovery

- Identify duplicate submissions, retries, duplicate webhooks, and race conditions.
- Use idempotency, a lock, or a transaction constraint according to the risk.
- Do not infer a financial state only from the browser response.
- Separate intent, external confirmation, and business state.
- Test prohibited transitions and recovery after a failure.

## Security

- Keep authentication and authorization separate.
- Apply authorization in the backend. Do not rely only on the user interface.
- Test isolation between users, organizations, or tenants.
- Inject secrets and make them rotatable.
- Send the minimum data to third parties and AI systems.
- Apply the `P21` data protections to first-party runtime log records from the application and its integrations.
- Set timeouts and limits for external calls.

## Operations

- Use useful and accurate health checks.
- Apply `P21` to each first-party runtime log record.
- Define the public or API error-code contract separately from runtime logging.
- Use technical and business metrics without personally identifiable information.
- Do not make observability necessary for service operation.
- Define procedures to start, stop, restart, and diagnose the service.
- Define explicit resource limits.

## Minimum gate

- formatting, static analysis, and unit tests;
- integration tests with the important real boundaries;
- contract validation and diff detection;
- forward migration, restore, or correction strategy;
- authorization and isolation;
- idempotency and external errors;
- production artifact build;
- startup in the target environment;
- health check and critical path.

Source: https://nclsppr.github.io/project-foundation/profiles/backend-data/index.mdx