Security and compliance

​

Transport security

• TLS/HTTPS Only: All communication must use HTTPS
• Certificate Validation: Verify SSL certificates
• Token Security: Store client credentials securely (never in source code or client-side applications)

​

Audit logging

• Timestamp of request
• Client ID and Company ID
• Endpoint accessed and HTTP method
• Response status code and response time
• IP address and user agent

​

Data access

• Company Isolation: API responses limited to your company’s data only
• No Cross-Company Access: Cannot access other companies’ information
• Data Retention: Audit logs retained per compliance requirements

​

Webhook security

• Use HTTPS endpoints only
• Provide a secret for HMAC signature verification
• Verify webhook signatures on your server
• Implement idempotency to handle duplicate deliveries
• Allowlist webhook source IP addresses in your firewall (see Webhook Delivery Format)