> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ofiniti.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and compliance

> Transport security, audit logging, data isolation, and webhook security requirements.

## Transport security

* **TLS/HTTPS Only:** All communication must use HTTPS
* **Certificate Validation:** Verify SSL certificates
* **Token Security:** Store client credentials securely (never in source code or client-side applications)

## Audit logging

FuelBoss logs all API requests for security and compliance:

* Timestamp of request
* Client ID and Company ID
* Endpoint accessed and HTTP method
* Response status code and response time
* IP address and user agent

## Data access

* **Company Isolation:** API responses limited to your company's data only
* **No Cross-Company Access:** Cannot access other companies' information
* **Data Retention:** Audit logs retained per compliance requirements

## Webhook security

When configuring webhooks:

* Use HTTPS endpoints only
* Provide a `secret` for HMAC signature verification
* Verify webhook signatures on your server
* Implement idempotency to handle duplicate deliveries
* Allowlist webhook source IP addresses in your firewall (see [Webhook Delivery Format](/fuelboss/api-integration-guide/webhooks#webhook-delivery-format))


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.