




Have any questions? We’re here to help You
Makini is SOC 2 Type 2 compliant and undergoes penetration testing twice annually. We use industry-standard encryption protocols including TLS 1.2+ for data in transit and AES-256 for data at rest. Customer credentials are encrypted using secure key management practices. Our infrastructure follows security best practices including network segmentation, access controls, and regular security audits. For highly regulated industries or customers with strict compliance requirements, we offer self-hosted deployment options that keep all data within your infrastructure. We've successfully met security requirements for enterprises including financial institutions and government contractors.
Makini's purchase order data model includes comprehensive field coverage across all major ERP systems. Standard fields include order number, line items, vendor information, quantities, unit prices, dates (order date, required date, delivery date), status, currency, ship-to and bill-to addresses, payment terms, and custom fields. Each line item includes product/material codes, descriptions, quantities, unit of measure, pricing, and delivery information. The specific fields available depend on the source system's capabilities. You can view the complete field mapping for any connected system in the Makini dashboard, and custom fields can be added as needed for your specific requirements.
Industrial systems are often heavily customized, and Makini is built to handle this. For reading data, Makini can access virtually any field or custom table in connected systems. Through the connection settings interface, you can specify custom fields, tables, or entities to include in API responses. These show up alongside standard fields in the unified model. For custom objects not in our default model, you can request them through the interface and they'll be available immediately. For writing data, customization support varies by system but covers most common scenarios. During implementation, we work with you to identify required customizations and ensure they're properly configured before going live.
Design your webhook receiver to handle duplicates and out-of-order webhooks, as network issues or retries can cause both scenarios. Keep the receiver lightweight—ideally writing incoming webhooks to a queue or reliable storage—then process them asynchronously. This prevents timeouts and allows your system to handle high-volume webhook spikes. Respond with a 200 status code immediately after receiving the webhook, before processing begins. Implement idempotency by tracking processed webhook IDs and skipping duplicates. Use constant-time comparison for signature verification to prevent timing attacks. If webhook processing fails, log the error but still return 200 to prevent unnecessary retries. Set up monitoring and alerts for webhook failures so you can investigate issues promptly. For critical workflows, combine webhooks with periodic polling as a fallback mechanism.
