Acceptable Use Policy

Use Hookstride only for systems, workspaces, destinations, devices and third-party services that you own, administer, or have explicit permission to integrate. Do not impersonate another user, bypass project controls, or submit webhooks to a destination without the receiving party's consent.

• Malware, ransomware, credential theft, phishing, fraudulent transactions, deceptive messages or spam.
• Denial-of-service traffic, unauthorized stress testing, malicious scanning, automated exploitation or attempts to discover internal/private network services.
• Use of Hookstride as an unrestricted HTTP proxy, scraping service, botnet transport, spam relay, or means of evading network controls.
• Intentional quota circumvention, deceptive account creation, fraudulent payment activity, key sharing between unrelated users, or unauthorized resale.
• Interference with the availability, security, integrity or privacy of the Services or another tenant.
• Processing or distributing content that violates applicable law or third-party rights.

Send only data needed by your receivers. Do not embed API keys, passwords, recovery codes, card numbers, government identity scans, biometric templates, sensitive medical data, or other protected information in event payloads without a supported, lawful, separately agreed processing arrangement. Never use public test receivers with live personal data.

Configure publicly reachable, authorized HTTPS receiving endpoints. You must maintain signatures, TLS, idempotency controls, safe response behavior and sufficient capacity. You may not create routes to internal IP ranges, cloud metadata services, unauthorized third parties or endpoints designed to exploit redirects or DNS behavior.

When connecting Paystack, Stripe, GitHub or a custom sender, you are responsible for the lawful use of its verification credentials. Some providers use high-trust full-access API keys to sign their webhooks; assess the risk before storing such credentials in any intermediary.

Do not depend on asynchronous webhooks as the sole control path for emergency response, critical medical interventions, industrial safety shutoffs, physical access control, or other operations where a delayed or duplicated message could cause serious harm. Implement independent safeguards and fail-safe behavior for such systems.

Honor event quotas, payload limits, rate limits, fan-out limits and retry policies disclosed by the API or plan. Hookstride may throttle, queue, reject, or suspend traffic that creates an unreasonable risk to the service, other customers, receiving systems or upstream infrastructure. Contact support before planned high-volume testing.

You may report a suspected vulnerability in good faith through our Security Reporting Policy. Do not scan other users' data, test production denial-of-service conditions, exfiltrate secrets, or disclose a vulnerability publicly before we have had a reasonable opportunity to investigate. We do not operate a public bug-bounty reward program.

We may warn, rate-limit, block a destination, revoke credentials, suspend an account, or report unlawful activity as appropriate to the nature and seriousness of the concern. Where practical and safe, we will provide notice and an opportunity to remedy. You may appeal an enforcement decision through support.