> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trytikt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Addresses TIKT accepts, how it proves requests are its own, and what it never sends.

## Addresses

* **`https://` only**, without a user name or password in the address.
* **No private or internal address.** TIKT refuses `localhost`, internal names and private IP addresses when you create a destination — and checks again at each request, after looking the name up, so an address that later points inside a network is never reached.
* **Redirects are not followed.**

## Proving a request is ours

**TIKT's IP addresses are not fixed: don't allow-list them. Verify the signature** of each request with your destination's secret — see [Verify signatures](/webhooks/signatures).

* The **signing secret** (`whsec_…`) is shown once, when you create the destination or rotate it. TIKT stores it encrypted.
* **Your own headers** (up to three per destination) are stored encrypted too, and never shown again: to change one, type it again.
* **A Slack address is itself a key.** TIKT shows only its beginning (`https://hooks.slack.com/…`), in the console and in the events.

## What is never sent

No event ever carries the raw data TIKT reads, the names of the services TIKT uses to read LinkedIn, the scoring model, costs, the way TIKT decides what to collect, the people TIKT processed who did not become leads, or a secret.

## Personal data

Events about leads carry personal data: a person's name, their LinkedIn profile, their job, what they wrote. Send them only to tools you control, and keep the signing secret private.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.