Security & Privacy at Autometon

Pass-Through Architecture

When an app sends a webhook to Autometon, the payload is received, validated, transformed according to your field mappings, and written directly to your Google Sheet. The payload content is then discarded. We store only metadata — timestamp, pipeline ID, event type, success/error status — for dashboard display and debugging.

This means your CRM deals, customer records, payment data, and analytics events never sit in our database. They live in Google Drive, under your Google account, subject to Google's enterprise-grade security — not ours.

Webhook Signature Verification

Autometon verifies HMAC webhook signatures for supported platforms automatically. When you connect Stripe, HubSpot, Shopify, or GitHub, every incoming webhook is validated against your signing secret before being processed. Payloads that fail signature verification are rejected and logged.

For platforms that don't support HMAC signing, Autometon generates a unique webhook URL per pipeline — guessable only by the app you configure.

Google Sheets Access

Autometon accesses your Google Sheets using a service account model. You share a specific spreadsheet with our service account email — we receive write access to that sheet only. We do not request access to your entire Google Drive, Gmail, or any other Google service.

Revoke access at any time by removing the service account from your sheet's sharing settings. Your data remains fully intact in Google Drive.

Data Security Practices

• TLS 1.2+ encryption on all data in transit
• bcrypt password hashing with per-user salt — we never store plaintext passwords
• Rate limiting on all API endpoints to prevent abuse and brute-force attacks
• HMAC signature verification for HubSpot, Shopify, Stripe, and GitHub webhooks
• Minimal data retention — event metadata purged after 90 days, server logs after 30 days
• MFA-protected production access, limited to essential personnel
• Dependency audits and security patching on a regular schedule

Responsible Disclosure

If you discover a security vulnerability in Autometon, please contact us at security@Autometon.io before disclosing publicly. We respond within 48 hours and commit to working with researchers in good faith. We do not pursue legal action against good-faith disclosure.

Privacy Policy

For full details on data collection, retention, and your rights, see our Privacy Policy.