to_proplist is safe by default, from_proplist/2 second argument Opts | Model