You are employed by a bank that adheres to rigorous data governance standards. Recently, you integrated a custom model designed to identify fraudulent transactions. Your intention is to configure your training code to access internal data through an API endpoint hosted within your project's network. Your primary concerns are to ensure the utmost security in accessing this data and to minimize the potential risk of data exfiltration. What steps should you take to achieve these objectives?