




Have any questions? We’re here to help You
Makini is SOC 2 Type 2 compliant and undergoes penetration testing twice annually. We use industry-standard encryption protocols including TLS 1.2+ for data in transit and AES-256 for data at rest. Customer credentials are encrypted using secure key management practices. Our infrastructure follows security best practices including network segmentation, access controls, and regular security audits. For highly regulated industries or customers with strict compliance requirements, we offer self-hosted deployment options that keep all data within your infrastructure. We've successfully met security requirements for enterprises including financial institutions and government contractors.
API tokens must be stored securely and should never be exposed on the client side or in public repositories. Store tokens in secure environment variables or dedicated secrets management systems like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault. Never hardcode tokens in application code or commit them to version control. Implement proper access controls so only authorized services can access stored tokens. For production environments, use separate tokens from development/testing environments. Rotate tokens periodically and immediately revoke tokens if you suspect they've been compromised. Makini tokens provide access to customer data, so treat them with the same security standards you'd apply to database credentials.
All Makini webhooks include a signature header for verification. The signature is an HMAC hash of the webhook payload using your webhook secret as the key. To verify a webhook, compute the HMAC using your secret and compare it to the signature header using constant-time comparison to avoid timing attacks. Never process webhook data without verification, as this could expose your system to forged requests. Your webhook secret is provided when you configure webhooks and should be stored securely. Webhook verification ensures that only legitimate requests from Makini are processed by your application.
Makini supports create, read, update, and delete (CRUD) operations, though availability varies by system and entity type. Most systems support creating and updating core entities like purchase orders, work orders, and inventory items. Read operations are universally supported across all entity types. Delete operations are less commonly supported due to system constraints—many industrial systems use soft deletes or status changes rather than true deletion. Update operations may be limited to specific fields depending on system configuration and business rules. For example, some systems prevent modifying purchase orders after approval. We recommend validating specific operation support for your use case during the technical deep dive.
