Skip to main content

​
Addresses

  • https:// only, without a user name or password in the address.
  • No private or internal address. TIKT refuses localhost, internal names and private IP addresses when you create a destination — and checks again at each request, after looking the name up, so an address that later points inside a network is never reached.
  • Redirects are not followed.

​
Proving a request is ours

TIKT’s IP addresses are not fixed: don’t allow-list them. Verify the signature of each request with your destination’s secret — see Verify signatures.
  • The signing secret (whsec_…) is shown once, when you create the destination or rotate it. TIKT stores it encrypted.
  • Your own headers (up to three per destination) are stored encrypted too, and never shown again: to change one, type it again.
  • A Slack address is itself a key. TIKT shows only its beginning (https://hooks.slack.com/…), in the console and in the events.

​
What is never sent

No event ever carries the raw data TIKT reads, the names of the services TIKT uses to read LinkedIn, the scoring model, costs, the way TIKT decides what to collect, the people TIKT processed who did not become leads, or a secret.

​
Personal data

Events about leads carry personal data: a person’s name, their LinkedIn profile, their job, what they wrote. Send them only to tools you control, and keep the signing secret private.