




Have any questions? We’re here to help You
Makini is SOC 2 Type 2 compliant and undergoes penetration testing twice annually. We use industry-standard encryption protocols including TLS 1.2+ for data in transit and AES-256 for data at rest. Customer credentials are encrypted using secure key management practices. Our infrastructure follows security best practices including network segmentation, access controls, and regular security audits. For highly regulated industries or customers with strict compliance requirements, we offer self-hosted deployment options that keep all data within your infrastructure. We've successfully met security requirements for enterprises including financial institutions and government contractors.
API tokens must be stored securely and should never be exposed on the client side or in public repositories. Store tokens in secure environment variables or dedicated secrets management systems like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault. Never hardcode tokens in application code or commit them to version control. Implement proper access controls so only authorized services can access stored tokens. For production environments, use separate tokens from development/testing environments. Rotate tokens periodically and immediately revoke tokens if you suspect they've been compromised. Makini tokens provide access to customer data, so treat them with the same security standards you'd apply to database credentials.
Makini sends webhooks for several event types: sync completion (successful or failed), connection authentication required (when credentials need renewal), connection status changes (online/offline), and system errors requiring attention. Each webhook payload includes the event type, timestamp, connection ID, and event-specific details like error messages or affected entities. You can configure which events trigger webhooks on a per-connection basis. For workflow-based integrations using Makini Flows, you can also set up custom webhooks triggered by specific conditions in your business logic, providing granular control over real-time notifications.
Makini implements automatic retry logic for failed webhook deliveries. If your endpoint is unavailable or returns an error status code, we retry delivery with exponentially increasing intervals starting at 30 seconds. Retries continue for up to 24 hours. If delivery ultimately fails, the webhook is logged but not delivered. You can view failed webhooks in the Makini dashboard and manually retry them. To prevent webhook loss during extended downtime, implement a polling backup strategy—periodically check the sync status and query for recent changes if no webhooks have been received within the expected time window. Design your webhook receiver to be idempotent, as retry logic may result in duplicate deliveries.
