Map the data before the workflow.
List what information enters the process, where it travels and which providers can access it. Include logs and error messages, because they can contain business information too.
Give each integration the access it needs.
Prefer scoped permissions and separately managed credentials. Document who controls access and how it can be revoked. Keep secrets out of front-end code and shared workflow exports.
Agree on retention and location.
Decide how long executions and documents need to be stored, how deletion works and whether a hosting region is required. These choices depend on your organisation and the data involved.
Treat security as ongoing work.
Review permissions and providers as the workflow changes. Use logs and alerts to support investigation, while avoiding unnecessary collection of sensitive information.