Security
How HookChat protects your data.
HookChat is in beta. This page describes the controls that are in place today and the limits you need to account for.
What is in place today
Encrypted credentials
Meta tokens and other secrets are encrypted with AWS KMS. Each secret can only be unlocked by the code that owns it, so the part of HookChat that sends webhooks can never read a Meta token.
Its own environment
Production runs in its own AWS environment with its own credentials and data stores, separate from test systems.
Signed webhooks
Every delivery carries an HMAC-SHA256 signature over the exact bytes, plus a timestamp. Check it with one SDK call and you know the event was signed with your endpoint secret and its body has not changed. The SDK rejects signatures outside its timestamp tolerance. Deduplicate by event id to reject repeats within that window. How to verify an event.
Audit trail
Key creation and revocation, webhook changes and automatic endpoint pauses, workspace and team changes are recorded: who, what, which resource, from where. Message content is never in the audit log.
Scoped API keys
Console-created API keys belong to one workspace. Operators can also issue keys with access to several workspaces. A conversation or message id outside a key's access returns a 404, so it cannot confirm that the record exists elsewhere. How keys and scopes work.
Secrets shown once
API keys are shown once and stored as hashes. Webhook signing secrets are also shown once, but are stored encrypted with KMS so the delivery worker can sign events. Neither has a read API that returns the secret. If you lose one, rotate it. How to rotate a secret without dropping a delivery.
Kept for a while, then gone
Each message expires 7 days after it was sent. A conversation stays while messages keep arriving, and expires 7 days after its last one. Delivery logs are kept 90 days, but the event body each one carried only 7, so a delivery can be replayed only within 7 days. The raw inbound events the gateway stores as they arrive expire after 7 days. Audit records are retained. The data-deletion flow removes the connected account's message data. What happens when a person asks Meta to delete their data.
HTTPS only, on every reply
Every page and every API reply comes over HTTPS. Browsers are told to stay on HTTPS for a year, so a typed http address is never sent in the clear. No page of ours can be shown inside another site, and nothing can be read as a type it is not. API replies are never cached, so none of your data sits in a shared cache. Nothing runs and nothing loads on the one page the API serves, so it cannot be turned against you.
Outbound delivery is guarded
The webhook URL is checked again before every delivery. Private and internal addresses, anything but https, and unsafe redirects are refused and never retried, so HookChat cannot be turned into a probe of your network or ours. A refused delivery shows as blocked in the delivery log.
Report a security issue
To report a security weakness in HookChat, email security@jiffi.co with "Security" in the subject, and say what you found and how to repeat it. Test only with your own workspace and accounts, and do not read, change or delete data that is not yours. The same contact is in our security.txt.