プラットフォームセキュリティ
Security at HioBuy
Last updated: August 6, 2026
We take the security of your account, API credentials, and integration data seriously. This page describes the controls we currently operate for the HioBuy Developer Platform. We only describe practices that are in place today.
1. API & Credential Security
Developer access to the HioBuy API is authenticated with per-app API keys managed in the Developer Portal.
- API keys can be created, rotated, and revoked from the portal so you can replace credentials without waiting on support.
- Keys are scoped to the application that owns them; requests are authorized against that app’s subscription and permissions.
- Rate limiting is enforced to reduce abuse and protect platform stability.
- API request activity is logged for troubleshooting and security review. Sensitive values such as API keys are redacted from log capture where applicable.
2. Data Protection
Traffic to HioBuy websites and APIs is served over HTTPS/TLS so credentials and payloads are encrypted in transit.
- We avoid storing full payment card numbers on HioBuy systems; billing is handled by our payment provider.
- Access to production systems and data is limited to authorized personnel who need it to operate the service.
- For how we collect and use personal data, see our Privacy Policy.
3. Webhook Security
When your app receives event webhooks from HioBuy, each delivery includes a signature header so you can verify authenticity.
- Deliveries are signed (HMAC) using your webhook secret and include a timestamp to help detect replayed requests.
- You should verify the signature before processing events and reject unsigned or invalid payloads.
- Rotate webhook secrets from the Developer Portal if a secret may have been exposed.
4. Account Access
Developer Portal accounts support email/password sign-in and Google sign-in. Password changes and Google account linking are available in account settings.
- Use a unique, strong password for your HioBuy developer account.
- Limit who has access to your Developer Portal login and API keys; treat keys like passwords.
- If you suspect unauthorized access, revoke affected API keys immediately and contact support.
5. Monitoring & Incident Response
We monitor platform health and API availability. Service status is published at status.hiobuy.com.
- Operational issues that affect API availability are reflected on the status page when detected.
- If we identify a security incident that materially affects your account or data, we will notify affected developers through available contact channels as promptly as practical.
- For urgent security concerns, email support@hiobuy.com with “Security” in the subject line.
6. Responsible Disclosure
If you believe you have discovered a security vulnerability in HioBuy, please contact support@hiobuy.com. Do not disclose the issue publicly before we have investigated it.
Helpful reports typically include: a clear description of the issue, affected product or URL, steps to reproduce, and any proof-of-concept details (without accessing other customers’ data).
Please do not perform destructive testing, social engineering of our staff, or privacy-invasive scanning against production systems or other users.
7. Contact Our Security Team
Security reports and related questions can be sent to Developer Support:
We aim to acknowledge security reports within 1–2 business days.