A developer connects Copilot Chat to a supported external model provider using Bring Your Own Key. Which two responsibilities must the team account for? Select 2 answers.

1. Assume GitHub pays every charge associated with the external provider key.
2. Evaluate the selected provider's data-retention and privacy terms for prompts and responses sent to it.
3. Treat output validation as unnecessary because the provider connection is authenticated.
4. Protect the provider API key and account for its usage costs or quotas.
5. Assume the external provider can never receive the prompt because the chat UI remains Copilot.