



Have any questions? We’re here to help You
Makini is SOC 2 Type 2 compliant and undergoes penetration testing twice annually. We use industry-standard encryption protocols including TLS 1.2+ for data in transit and AES-256 for data at rest. Customer credentials are encrypted using secure key management practices. Our infrastructure follows security best practices including network segmentation, access controls, and regular security audits. For highly regulated industries or customers with strict compliance requirements, we offer self-hosted deployment options that keep all data within your infrastructure. We've successfully met security requirements for enterprises including financial institutions and government contractors.
Industrial systems are often heavily customized, and Makini is built to handle this. For reading data, Makini can access virtually any field or custom table in connected systems. Through the connection settings interface, you can specify custom fields, tables, or entities to include in API responses. These show up alongside standard fields in the unified model. For custom objects not in our default model, you can request them through the interface and they'll be available immediately. For writing data, customization support varies by system but covers most common scenarios. During implementation, we work with you to identify required customizations and ensure they're properly configured before going live.
Makini sends webhooks for several event types: sync completion (successful or failed), connection authentication required (when credentials need renewal), connection status changes (online/offline), and system errors requiring attention. Each webhook payload includes the event type, timestamp, connection ID, and event-specific details like error messages or affected entities. You can configure which events trigger webhooks on a per-connection basis. For workflow-based integrations using Makini Flows, you can also set up custom webhooks triggered by specific conditions in your business logic, providing granular control over real-time notifications.
All Makini webhooks include a signature header for verification. The signature is an HMAC hash of the webhook payload using your webhook secret as the key. To verify a webhook, compute the HMAC using your secret and compare it to the signature header using constant-time comparison to avoid timing attacks. Never process webhook data without verification, as this could expose your system to forged requests. Your webhook secret is provided when you configure webhooks and should be stored securely. Webhook verification ensures that only legitimate requests from Makini are processed by your application.
