Hookbase
Get Started
01 / Security & Compliance

Architected for enterprise trust.

From dual HMAC verification to sovereign deployment options, security at Hookbase is built into every layer of our event pipeline.

Authentication & Access01

Account & Workspace Protection

Layered authentication and strict workspace isolation by design.

  • Passwords hashed with cryptographically salted bcrypt.
  • Mandatory or optional Two-Factor Authentication (TOTP & hardware security keys).
  • Enterprise SAML / SSO integration with Okta, Azure AD, and Google Workspace.
  • Role-based workspace memberships with granular principle of least privilege.
Cryptographic Integrity02

Dual HMAC Request Security

Cryptographic payload inspection before routing to downstream endpoints.

  • Real-time HMAC-SHA256 verification against provider signing secrets.
  • Tamper-proof payload storage with isolated raw headers and execution traces.
  • Explicit manual or programmatic replay actions — zero hidden unexpected retries.
  • Time-limited, cryptographically signed share URLs with instant revocation.
Data Lifecycle03

Retention & Compliance Purging

Transparent data retention schedules with hard deletion guarantees.

  • Deterministic retention policies: 7 days (Developer), 30 days (Team), 365 days (Enterprise).
  • Pinned forensic events remain protected until explicitly cleared by team engineers.
  • Hard deletion window: complete erasure of payload contents upon account closure.
  • GDPR & UK DPA compliant data processing agreements available on request.
Infrastructure Resilience04

Abuse Controls & Rate Limiting

Distributed traffic guards protecting your services from DoS storms.

  • In-memory Redis token buckets preventing concurrency surges on downstream services.
  • Automated circuit breakers and anomaly alerts on abnormal failure rates.
  • Workspace-scoped audit logging for administrative actions and configuration changes.
  • DDoS mitigation and TLS 1.3 enforced across all public ingestion endpoints.
02 / Responsible Disclosure

Vulnerability Reporting

We welcome reports from independent security researchers. If you believe you have discovered a vulnerability in Hookbase, please notify our security team directly.

[email protected]

Our Response Commitment

We acknowledge vulnerability submissions within 24 hours and provide transparent status updates until remediated. We do not take legal action against researchers acting in good faith.

Contact Security Team