The words yourvendor won’t define.

API

Application Programming Interfaceweb

A defined list of things one system will do for another, and the exact shape of the request required to ask.

Why it existsSo two systems can work together without either knowing how the other is built. Everything behind an API can change as long as the shape stays the same.

"Does your software have an API?" means: can other tools talk to it automatically, or is someone retyping data by hand?

endpoint

web

One specific address on an API that does one specific thing.

Why it existsAn API is the whole menu. An endpoint is a single item on it.

A developer saying "I'll build you an endpoint for that" means one new, narrow capability — usually hours, not weeks.

JWT

JSON Web Token, said "jot"identity

A small packet of facts about a user — their ID, their role, their company — cryptographically signed so it cannot be edited without detection.

Why it existsIt lets a system trust a claim about you without looking you up in a database on every single click. Almost entirely a speed decision.

Any modern login uses one. If a vendor can't tell you how long theirs stays valid, that's worth pushing on.

claim

identity

One fact stored inside a token. "Role: manager" is a claim.

Why it existsBundling facts into the token means the system can make permission decisions instantly instead of querying a database first.

sign / verify

identity

Signing stamps data with a secret key. Verifying proves the stamp is genuine and nothing was altered.

Why it existsIt is a wax seal. Anyone can read a sealed letter, but only the holder of the seal can create one.

public / private key

identity

A matched pair. The private one signs; the public one verifies. Publishing the public key is safe and expected.

Why it existsLets anyone in the world confirm a message came from you, while only you can produce one.

UUID

Universally Unique Identifierdatabase

A 36-character random ID, like 8f14e45f-ceea-467a-9e2c-1d2a4b6c8e10. Two systems can generate them independently and never collide.

Why it existsEmails change and names repeat. An ID never moves, so it's what the database actually keys on.

session

identity

The system's memory that this particular person is currently signed in.

Why it existsThe web forgets you between every single request. A session is the thread that survives from one click to the next.

cookie

identity

A small piece of data a site asks your browser to hold and send back on every future request.

Why it existsIt's a coat check ticket. Your browser carries it automatically, which is why you don't log in again on every page.

SSO

Single Sign-Onidentity

One login that opens every tool your company uses, instead of a separate password per app.

Why it existsFewer passwords means fewer reused passwords, and one switch turns off a departing employee's access everywhere at once.

Worth asking any vendor. "Do you support SSO?" tells you a lot about how seriously they take security.

OAuth

identity

The standard handshake behind "log in with Google." The other service never sees your password — it receives a limited token instead.

Why it existsLets you prove who you are to a company without handing them a credential they'd then be responsible for protecting.

401 vs 403

web

401 means "I don't know who you are." 403 means "I know exactly who you are, and the answer is no."

Why it existsTwo very different problems. Confusing them sends a developer debugging the wrong half of the system.

If your team reports "it says 403," the login worked and a permission is missing. That's a settings problem, not a bug.

TTL

Time To Liveinfra

How long something stays valid before it's thrown away — a login token, a cached page, a DNS record.

Why it existsNothing should be trusted forever. A short TTL means a revoked permission takes effect sooner.

MFA / 2FA

Multi-Factor / Two-Factor Authenticationidentity

Requiring a second proof beyond a password — a code, an app prompt, a hardware key.

Why it existsPasswords leak in bulk. A second factor means a stolen password on its own is worthless.

The single highest-value security change most small companies can make in an afternoon.

SQL

Structured Query Language, said "sequel"database

The language for asking a database questions. SELECT reads, INSERT adds, UPDATE changes, DELETE removes.

Why it existsOne language that nearly every database in the world speaks, essentially unchanged since the 1970s.

Postgres

PostgreSQLdatabase

A database — the program that stores your records and answers questions about them.

Why it existsFree, extremely reliable, and the default serious choice. If a vendor says "we run on Postgres," that's a good sign, not a red flag.

schema

database

The shape of your data — which tables exist, what fields they have, and what kind of value each one accepts.

Why it existsThe database enforces the shape, so malformed data can't get in through a side door.

row / column

database

A row is one record — one customer, one job. A column is one field on every record — every customer's phone number.

Why it existsSpreadsheet vocabulary, and the analogy holds almost perfectly.

query

database

One question asked of the database.

Why it existsEverything an app displays started as a query. "The report is slow" almost always means "one query is slow."

transaction

database

A group of database changes that all succeed together or all get undone together. Nothing lands halfway.

Why it existsMoney moving between two accounts must not stop in the middle. Same principle protects an order, an invoice, or a job record.

migration

database

A numbered file, saved in version control, that changes the database's structure. Applied in order, never edited after it ships.

Why it existsSo the test copy and the live copy have identical structure, and anyone can answer "when did this field appear, and who added it?"

If a vendor changes your database by clicking around in an admin panel instead, ask how they'd undo it.

RLS

Row Level Securitydatabase

The database attaching its own filter to every read and write, no matter what the application asked for.

Why it existsBecause applications forget. One missing filter in one place is how one customer sees another customer's data. Enforcing it in the database means the app cannot make that mistake.

The right question for any vendor holding data for multiple customers: "Where is tenant isolation enforced — in the app or in the database?"

policy

database

One row-level security rule. "When reading jobs, only return the ones belonging to the caller's company."

Why it existsThe rule lives next to the data instead of being scattered across a hundred different screens and reports.

index

database

A lookup structure that lets the database find matching records without reading every single one.

Why it existsThe difference between a search taking four milliseconds and four seconds. Most "the system got slow as we grew" complaints are a missing index.

SQL injection

database

An attack where text typed into a form gets treated as database commands instead of as data.

Why it existsThe classic version is a name field containing a command that deletes a table. It's decades old, completely preventable, and still in the top ten breaches every year.

tenant

database

One customer in a system that serves many, whose data must never touch another customer's.

Why it existsOne application, one database, many companies. It's how nearly all business software is built — and the isolation between tenants is the whole ballgame.

"Multi-tenant" means you share infrastructure with other customers. That's normal and fine. How they separate you is the question.

backup vs replica

database

A backup is a copy from a point in time you can restore from. A replica is a live second copy kept in sync right now.

Why it existsThey solve different disasters. A replica survives hardware failure. Only a backup survives someone deleting the wrong thing on Tuesday.

"We have replication" is not the same as "we have backups." Ask for both, and ask when a restore was last tested.

ORM

Object Relational Mapperdatabase

A library that writes database queries for you from ordinary code.

Why it existsConvenience and consistency. The tradeoff is that it can hide an inefficient query until your data grows.

request / response

web

The whole of the web. Something asks, something answers, and then both sides forget it happened.

Why it existsEverything else — logins, sessions, cookies — exists to add memory to a system that has none by default.

HTTP verbs

web

GET reads. POST creates. PUT and PATCH update. DELETE removes.

Why it existsA shared convention, so any developer can guess what a piece of a system does before reading a line of it.

CRUD

Create, Read, Update, Deleteweb

The four things every business application does to data. Most software is CRUD with opinions on top.

Why it existsUseful for scoping. "It's CRUD plus a PDF export and a nightly email" tells a builder almost everything they need to quote it.

JSON

JavaScript Object Notationweb

The standard text format for passing structured data between systems. Curly braces and label-value pairs.

Why it existsReadable by a human, parseable by every programming language. It won because it was the simplest thing that worked.

status code

web

The three-digit verdict on every web response. 200 is fine, 3xx moved, 4xx you made a mistake, 5xx we made a mistake.

Why it existsThe 4xx versus 5xx split is the fastest triage in software: your fault or theirs.

"It's throwing 500s" means the vendor's system is broken, not your team's usage.

client-side

web

Code running on the user's own phone or laptop. Visible to them, editable by them, and therefore untrusted.

Why it existsAnything checked here can be skipped by a determined user. It's for convenience, never for enforcement.

If a vendor says a permission is "handled in the interface," that's not a security control. Ask where it's enforced on the server.

server-side

web

Code running on the company's own machines. Never downloaded, never visible to the user.

Why it existsThe only place secrets and real decisions belong, because it's the only place a user cannot reach.

bundle

web

The package of code compiled and shipped down to a visitor's browser.

Why it existsAnything in the bundle is public, whether you meant it to be or not. It's the single most common way an API key leaks.

SSR / CSR

Server-Side / Client-Side Renderingweb

With SSR the server sends a finished page. With CSR it sends a blank page plus instructions for the browser to draw it.

Why it existsSSR shows up faster and is visible to Google. CSR feels more app-like once loaded. Most modern sites mix both.

If a site's content is invisible in search results, rendering strategy is the first thing to check.

SPA

Single Page Applicationweb

A site that loads once and then swaps content in place instead of reloading whole pages.

Why it existsFeels like software rather than a website. Costs a heavier first load in exchange.

PWA

Progressive Web Appweb

A website that installs to a phone's home screen and keeps working with no signal.

Why it existsApp-store reach without app-store approval, review delays, or a 30% cut. Often the right answer for an internal field tool.

polling

web

Asking a server "anything new yet?" on a repeating timer.

Why it existsThe simple alternative to a live connection. Costs bandwidth, buys reliability — and reliability usually wins for business software.

webhook

web

The reverse of polling. Instead of you asking repeatedly, the other system calls you the moment something happens.

Why it existsInstant instead of delayed, and far cheaper than checking every thirty seconds forever.

The backbone of most automation. "Does it support webhooks?" decides whether two tools can be wired together cleanly.

CORS

Cross-Origin Resource Sharingweb

The browser rule that a page on one website can't freely call another website's API unless invited.

Why it existsIt stops a malicious page from quietly reading data you're logged into somewhere else.

cache

web

A saved copy of something expensive, handed out instead of recalculated.

Why it existsSpeed. It's also the number one reason someone says "I published the change and the site looks exactly the same."

There are three separate caches in play — the browser's, the delivery network's, and the app's. Naming which one is most of the fix.

CDN

Content Delivery Networkinfra

Copies of a site's files parked in data centers worldwide so visitors load from one nearby.

Why it existsPhysics. A round trip from Indiana to Virginia has a floor that no amount of clever code can beat.

rate limit

web

A cap on how many requests one caller can make in a window. Exceed it and you get refused until it resets.

Why it existsProtects a system from both abuse and an accidental infinite loop in somebody's script.

Ask about limits before building an integration. Discovering them in production is an expensive way to learn.

DNS

Domain Name Systeminfra

The phone book that turns a domain name into the numeric address of a server.

Why it existsHumans remember names; networks route numbers.

"It's a DNS issue" usually means the site is fine and the directions to it are wrong. Changes can take hours to spread.

TLS / HTTPS

Transport Layer Securityinfra

The encryption wrapping traffic between a browser and a server. The padlock in the address bar.

Why it existsWithout it, anyone on the same coffee-shop wifi can read the session cookie and become that user.

load balancer

infra

The traffic director out front, spreading incoming visitors across however many copies of an application are running.

Why it existsOne server can fail and nobody notices. It's also how a system handles a traffic spike without falling over.

container

infra

An application plus its exact dependencies, sealed in a box that runs identically on any machine.

Why it existsIt permanently killed "well, it works on my computer."

environment variable

infra

A configuration value handed to an application when it starts, instead of being written into the code.

Why it existsThe same code runs in testing and production with different settings, and no password ever gets committed to version control.

secret

infra

Any value that grants access — an API key, a database password, a signing key.

Why it existsThe one category of value that must never reach a user's browser. Treat a leaked key as compromised the moment it's exposed, not when someone abuses it.

CI/CD

Continuous Integration / Continuous Deploymentinfra

Automation that tests every change and ships the ones that pass.

Why it existsIt removes the step where a human forgets to run the tests before shipping on a Friday.

staging vs production

infra

Staging is the rehearsal copy. Production is the one real customers touch.

Why it existsSo a mistake costs a redeploy instead of a customer. A vendor with no staging environment is testing on you.

deploy

infra

The act of putting new code onto the live system.

Why it existsModern teams deploy many times a day. A shop that deploys quarterly usually has a fear problem, not a quality one.

rollback

infra

Putting the previous version back after a bad deploy.

Why it existsSpeed of undo is a feature. It's why database changes are numbered and every release is versioned.

Fair question for any vendor: "If a release breaks something, how fast can you put it back?"

cron

infra

A scheduler that runs a task on a fixed timetable — nightly, hourly, every Monday.

Why it existsReports, syncs, cleanup. The classic failure is that it stops running and nobody notices for weeks, because success is silent.

If a scheduled job matters, it needs an alert on failure. Silence is not evidence it ran.

uptime / SLA

Service Level Agreementinfra

The percentage of time a system is available, and the contractual promise attached to it.

Why it exists99.9% sounds identical to 99.99% and is ten times more downtime — about nine hours a year versus fifty minutes.

logs

infra

The running written record of what a system did and when.

Why it existsThe first place anyone looks when something breaks. A system with no logs can only be debugged by guessing.

LLM

Large Language Modelai

The model itself — Claude, GPT, Gemini. A program that predicts the next chunk of text given everything before it.

Why it existsThat one mechanic, at enough scale, turns out to cover writing, reasoning, summarizing, coding, and using tools.

token

ai

A chunk of text, roughly three quarters of a word. Models read, write, and are billed in tokens.

Why it existsEvery cost and every limit in AI is measured here. Rough math: 1,000 tokens is about 750 words.

Nothing to do with a login token. Same word, unrelated meaning — see the overloaded words below.

context window

ai

The total amount of text a model can hold in mind at once — your input plus its answer.

Why it existsIt's the hard ceiling on "just paste the whole manual in." This single constraint is why retrieval systems exist.

prompt

ai

Everything sent to the model: the instructions, the data, and the question.

Why it existsIt's the entire input, not just the question you typed — which is why prompt design turns out to be most of the work.

system prompt

ai

Standing instructions set before a conversation starts, defining the assistant's role, rules, and tone.

Why it existsPersistent behavior without repeating yourself every message. It's how a generic model becomes your company's assistant.

inference

ai

One run of a model producing an answer. It's what you pay for, per call.

Why it existsDistinguishes using a model — cheap and instant — from training one, which is neither.

RAG

Retrieval Augmented Generationai

Search your own documents first, paste only the relevant passages into the prompt, then ask the question.

Why it existsIt solves three problems at once: your documents don't fit in the context window, sending them all would cost a fortune, and accuracy drops when the answer is buried in noise.

This is what "train the AI on our documents" almost always actually means — and it's far cheaper and faster than real training.

embedding

ai

A block of text converted into a long list of numbers that encodes its meaning. Similar meanings produce similar numbers.

Why it existsIt lets a computer match "how do I reset a customer's password" to a document titled "credential recovery procedure." Keyword search cannot do that.

vector database

ai

A database built to find the closest embeddings quickly.

Why it existsAn ordinary database matches exact values. This one matches meaning. It's the storage half of any RAG system.

chunking

ai

Splitting long documents into passages before storing them for retrieval.

Why it existsRetrieve a whole 200-page manual and you're back to the context problem. Chunk size is the main tuning dial in a retrieval build.

agent

ai

A model given tools and a goal, working in a loop — decide, act, check the result, decide again — until the job is done.

Why it existsThe jump from "writes you an answer" to "completes the task." This is what most AI automation projects are actually buying.

tool call

also called function callingai

The model asking your software to run something — look up an order, send an email, query a report — and hand back the result.

Why it existsLets a model act on live company data instead of only on what it memorized during training.

MCP

Model Context Protocolai

A standard shape for exposing your tools and data to any AI assistant, so any model can use them without custom wiring.

Why it existsBefore it, every model-and-tool pairing needed its own bespoke integration. Now one connector works everywhere. That's the entire value.

Increasingly the answer to "how do we connect our AI to our actual systems?"

fine-tuning

ai

Further training a model on your own examples so it absorbs a specific style or task.

Why it existsRarely the right first move. Better prompting and retrieval solve most of what people reach for fine-tuning to fix, at a small fraction of the cost and time.

If a vendor opens with fine-tuning, ask what they tried first. It's often a sign of an expensive answer to a cheap problem.

hallucination

ai

A model producing something fluent, confident, and completely false.

Why it existsNot a bug on a roadmap — a property of how prediction works. Serious systems are designed around it with source citations, grounding, and human approval steps.

Any vendor promising it's "solved" is overselling. The right answer describes the guardrails, not the absence of the problem.

temperature

ai

A dial controlling randomness. Low is repeatable and literal. High is varied and creative.

Why it existsPulling data out of invoices wants low. Writing five ad variations wants high. One setting cannot serve both.

eval

evaluationai

A test suite for AI output — a fixed set of inputs with graded expectations, run after every change.

Why it existsThe only way to know a change improved things rather than quietly breaking them. Most teams skip it, which is why their AI features silently degrade.

"How do you measure whether it's getting better?" separates a real AI build from a demo.

human in the loop

ai

A required person-approves-it step before an AI action takes effect.

Why it existsLets you deploy automation before you fully trust it. The review step is removed later, once the numbers earn it — not on day one.

Same word, two meanings

Most confusion in a technical meeting doesn’t come from words you’ve never heard. It comes from words you know that quietly mean something else in the room. Nobody warns you about these.

How to decode a word that isn’t on this list