AI provider API calls use encrypted transport

GDPR Article 32 requires that personal data be transmitted with appropriate technical security measures — which universally means TLS encryption. CWE-319 (Cleartext Transmission of Sensitive Information) and OWASP A02 (Cryptographic Failures) both apply when AI prompt data travels over unencrypted HTTP. AI prompts contain user input in its rawest form: questions, documents, instructions, and frequently PII the user embedded without realizing it. Any network observer on the path between your server and the AI provider endpoint — a misconfigured proxy, a shared hosting environment, a compromised network hop — can read every prompt in plaintext. NIST SP 800-53 Rev. 5 SC-8 mandates transmission confidentiality as a baseline control.

Ensure any custom baseURL configured in your AI client starts with https://. Official SDK default endpoints are already HTTPS — only custom or self-hosted endpoints need verification.

// Correct:
const openai = new OpenAI({
  baseURL: 'https://your-proxy.example.com/v1',
  apiKey: process.env.OPENAI_API_KEY
})

// Wrong — never in production:
const openai = new OpenAI({
  baseURL: 'http://your-proxy.example.com/v1',
})

For local development mocks (Ollama, LM Studio), guard the HTTP URL behind a NODE_ENV check so it cannot accidentally reach production:

const openai = new OpenAI({
  baseURL: process.env.NODE_ENV === 'development'
    ? 'http://localhost:11434/v1'
    : 'https://api.openai.com/v1'
})

Verify by searching the codebase for http:// (not https://) in any string adjacent to AI client configuration.