Customer.io Security Basics

Overview

Implement security best practices for Customer.io integrations including credential management, PII handling, webhook verification, and GDPR compliance.

Prerequisites

• Customer.io account with admin access
• Understanding of your data classification
• Environment variable management

Instructions

Step 1: Set Up Secure Credential Management

Use a secrets manager (GCP Secret Manager, AWS Secrets Manager) instead of environment variables for production credentials.

Step 2: Implement PII Data Handling

Hash sensitive identifiers with SHA-256 before sending. Sanitize user attributes to remove highly sensitive fields (SSN, credit card) and optionally hash PII fields (phone, address).

Step 3: Configure API Key Rotation

Establish a 90-day rotation schedule. Automate through secrets manager where possible with zero-downtime rotation procedures.

Step 4: Secure Webhook Endpoints

Verify Customer.io webhook signatures using HMAC-SHA256 with crypto.timingSafeEqual. Create Express middleware for automatic verification.

Step 5: Implement Access Controls

Define role-based permissions (admin, editor, viewer) and enable audit logging for security-sensitive operations.

Step 6: Handle Data Retention

Implement user suppression and deletion for GDPR/CCPA compliance. Create anonymization functions for historical analytics data.

For detailed implementation code and configurations, load the reference guide: Read(${CLAUDE_SKILL_DIR}/references/implementation-guide.md)

Security Checklist

• API keys stored in secrets manager
• API keys rotated every 90 days
• Webhook signatures verified
• PII sanitized before sending
• Minimum necessary data sent
• Team access follows least-privilege
• Audit logging enabled
• GDPR/CCPA deletion process documented
• SSL/TLS enforced for all API calls

Error Handling

Resources

• Customer.io Security
• GDPR Compliance
• Suppression API

Next Steps

After implementing security, proceed to customerio-prod-checklist for production readiness.

Output

• Configuration files or code changes applied to the project
• Validation report confirming correct implementation
• Summary of changes made and their rationale

See security implementation details for output format specifications.

Examples

Basic usage: Apply customerio security basics to a standard project setup with default configuration options.

Advanced scenario: Customize customerio security basics for production environments with multiple constraints and team-specific requirements.