Implementing Security Best Practices
1. Managing API Keys
| Practice | Detail |
|---|
| One key per service | Easier rotation / audit |
| Rotate every 90 days | Limit exposure window |
| Revoke on offboarding | Immediate |
| Use scoped keys (Enterprise) | Limit by index/permission |
2. Using Environment Variables
Example: Env-Driven Config
import os
pc = Pinecone(api_key=os.environ["PINECONE_API_KEY"])
3. Securing API Key Storage
| Store | Recommendation |
|---|
| AWS Secrets Manager | Best for AWS workloads |
| GCP Secret Manager | Best for GCP |
| HashiCorp Vault | Multi-cloud |
| .env in repo | Never |
4. Implementing IP Allowlisting
Note: IP allowlisting available on Enterprise plans. Configure in Pinecone console under project security.
| Field | Description |
|---|
| CIDR list | Allowed source IP ranges |
| Default | All IPs (open) |
5. Configuring Access Control
| Layer | Mechanism |
|---|
| Project | RBAC: owner / member / viewer |
| API key | Per-key permission scope (Enterprise) |
| SSO/SAML | Enterprise auth integration |
6. Using HTTPS Only
Note: All Pinecone endpoints are HTTPS only; HTTP traffic is rejected.
| Setting | Default |
|---|
| SSL verification | Enabled by default in SDKs |
| TLS version | TLS 1.2+ required |
7. Implementing Rate Limiting
Example: Client-Side Limit
from ratelimit import limits, sleep_and_retry
@sleep_and_retry
@limits(calls=100, period=1) # 100 calls/sec
def query(qv):
return index.query(vector=qv, top_k=10)
8. Implementing Namespace Isolation
Warning: Namespaces are NOT a security boundary. They share the API key. For untrusted-tenant isolation, use separate indexes or projects.
| Goal | Right Tool |
|---|
| Logical separation | Namespace |
| Data isolation | Separate index |
| Billing isolation | Separate project |
| Strategy | Detail |
|---|
| Don't store PII in metadata | Use opaque IDs; lookup in DB |
| Encrypt at app layer | If must store |
| Redact text snippets | Before embedding |
10. Auditing API Access
| Source | Detail |
|---|
| Pinecone audit logs | Enterprise: API + console actions |
| Application logs | Wrap SDK calls with structured logging |
| SIEM ingest | Forward to Splunk/Datadog |