Hookmetry security overview
Hookmetry processes webhook payloads, headers, endpoint secrets, account information, and diagnostic records. Treat an endpoint as part of your production data path and apply data minimization, credential protection, and least-privilege access.
Security boundaries
- Dashboard and authenticated API access use account credentials or bearer tokens.
- Endpoint and webhook-log operations are scoped to the authenticated account.
- Public capture URLs accept sender traffic and should be protected with provider signature validation when supported.
- Public debug links are separate, time-limited access paths to one selected event.
- Replay sends stored request data to a customer-selected destination and can cause side effects.
Customer security checklist
- Use a separate endpoint for each provider and environment.
- Enable the matching signature validator and protect the signing secret.
- Avoid capturing data that is not needed for debugging.
- Review retention requirements before sending production traffic.
- Restrict share links and replay destinations.
- Rotate secrets and account credentials after suspected exposure.
Webhook verification
Hookmetry validation helps diagnose the captured request. Your application remains responsible for authenticating webhook requests before applying business changes.
Compliance and assurance
Product controls and documentation do not by themselves establish a certification or regulatory compliance status. Contact Hookmetry for current security and contractual documentation needed for your review.