# Relevant video. Less customer data in the creative workflow.

Creating a relevant video does not always require sharing a customer's name, email or full profile. You can select the audience and product in your own system, then provide the content inputs needed to produce the chosen creative variation. The data boundary depends on what the video and delivery workflow actually need.

## Choose how much context crosses the boundary

![A data-minimizing pattern: audience selection stays in the customer application, selected content inputs pass to Engage, and the video result returns for delivery and measurement.](/assets/customer-data-boundary.442fd41c7e91c8494dbbb29bab645d853ecfa6d780d7ec42e818c274a3015b82.43c089e3.svg)

*Illustrative integration pattern: personal profiles stay in your system. Content supplied to Engage still crosses the boundary and may be personal or sensitive if you put it in the creative inputs.*

| Pattern | What you can supply | What stays in your system |
|  --- | --- | --- |
| Audience-relevant variation | Approved product, message, language and an opaque reference where the workflow requires one | Names, email addresses and the rules used to select that audience |
| Personal detail in the media | Only the specific values needed, such as a supplied first name for a spoken greeting | The remainder of the customer profile |
| Service-managed audience or delivery | The mapped records and destination fields required by that supported workflow | Unused profile fields and unrelated business data |


An opaque reference can still be personal data when linked to an individual. Minimize it, control the mapping in your own system and evaluate the inputs according to your own privacy requirements. This is a data-minimization pattern, not a claim that every integration shares zero data.

## Explicit mappings instead of a full-profile dump

Journey source setup uses declared field mappings. Imported records carry an external reference and the mapped values accepted by that source. Choose the fields needed for the selected story, product rule or delivery action; do not import unrelated contact attributes merely because they exist in your database.

Source listing and snapshot summaries can expose setup, counts and readiness without returning full contact rows. When inspecting samples, the supported source-sample operation requests named records and selected mapped fields. Those selected values are still customer data: consider what your assistant and connected tools will receive before requesting them.

Text, images and audio used for generation can also become inputs to the selected media provider. Review the processing requirements of that workflow as well as what is imported into Engage. Avoid putting a private profile attribute into a creative prompt when the video does not need it.

## Workspace access is checked at the operation boundary

- **Scoped credentials:** request the permissions required for the intended task. Reading templates, generating media, viewing results and sending campaigns are distinct authorities.
- **Workspace context:** use credentials for the authorized organization. A resource ID alone is not permission to read or modify it.
- **OAuth and machine keys:** use the connection method supported by your client. Keep keys in private client settings or server-side secret storage.
- **Revocation and expiry:** credentials remain subject to active policy, expiry and revocation; delegated key authority is bounded by its issuer.


See [authentication and access](/engage/authentication) for credential behavior and [MCP setup](/engage/mcp) for supported connection patterns.

## Protect the action, not just the connection

A safe integration also controls what happens after authentication. Mutation schemas can require idempotency values and current revisions. Journey reviews identify the artifacts being reviewed; a changed source or preview requires a current review rather than silently reusing an older approval.

Keep creation, paid generation, export and launch as explicit actions. Discovering a tool or saving a brief does not authorize every later action. The [agentic workflow guide](/engage/agentic-workflows) shows how these checkpoints fit together; [jobs and retries](/engage/errors) explains recovery behavior.

## A concrete low-data campaign

Your application selects an outdoor product for a customer using its own business rules. It asks the creative workflow for an approved product story in the desired language without sending the customer's name or email. Your application associates the returned video variation with the audience and handles delivery itself.

If you instead want the customer's name spoken aloud, that name must reach the part of the workflow that produces the speech. If a service sends an email or message, its delivery workflow needs the required destination. Choose the boundary intentionally rather than promising that no data is ever shared.

## Before connecting real customer systems

Use synthetic records while developing. Keep credentials out of URLs, prompts, browser bundles and shared logs. Review which information is visible to the assistant and which inputs the selected media workflow uses. For retention, subprocessors, deployment-specific controls or contractual requirements, [contact Shuffll](/contact) for the current terms and implementation details.