Security
How HookChat protects your data.
HookChat is in beta. This page describes the controls that are in place today. Nothing aspirational. We would rather under-claim and be accurate.
Encrypted credentials
Meta tokens and other secrets are protected with AWS KMS envelope encryption. Decryption is scoped by encryption context, so the delivery path has no route to Meta tokens.
Per-environment isolation
Staging and production run in separate AWS environments with separate credentials and data stores. There is no shared blast radius between them.
Signed webhooks
Every delivery is HMAC-SHA256 signed over the exact bytes, with a timestamp and replay tolerance, so you can prove an event came from HookChat and hasn't been tampered with.
Audit trail
Key creation and revocation, webhook changes and automatic endpoint pauses are recorded: who, what, which resource, from where. Message content is never in the audit log.
Tenant isolation
API keys are scoped to a tenant and every read is tenant-derived. A cross-tenant id returns a 404, never a 403: an id can never confirm it exists under another tenant.
Secrets shown once
API keys and webhook signing secrets are shown exactly once and stored only as hashes. A lost key is unrecoverable: you rotate it, you don't retrieve it.
Outbound delivery is guarded
Webhook URLs are checked against an SSRF gate before every delivery: deliveries to internal or link-local addresses, unexpected schemes, or unsafe redirects are refused outright and never retried.