Customer.io Security Basics

Overview

Implement security best practices for Customer.io integrations including credential management, PII handling, webhook verification, and GDPR compliance.

Prerequisites

Customer.io account with admin access
Understanding of your data classification
Environment variable management

Instructions

Step 1: Set Up Secure Credential Management

Use a secrets manager (GCP Secret Manager, AWS Secrets Manager) instead of environment variables for production credentials.

Step 2: Implement PII Data Handling

Hash sensitive identifiers with SHA-256 before sending. Sanitize user attributes to remove highly sensitive fields (SSN, credit card) and optionally hash PII fields (phone, address).

Step 3: Configure API Key Rotation

Establish a 90-day rotation schedule. Automate through secrets manager where possible with zero-downtime rotation procedures.

Step 4: Secure Webhook Endpoints

Verify Customer.io webhook signatures using HMAC-SHA256 with crypto.timingSafeEqual. Create Express middleware for automatic verification.

Step 5: Implement Access Controls

Define role-based permissions (admin, editor, viewer) and enable audit logging for security-sensitive operations.

Step 6: Handle Data Retention

Implement user suppression and deletion for GDPR/CCPA compliance. Create anonymization functions for historical analytics data.

For detailed implementation code and configurations, load the reference guide: Read(${CLAUDE_SKILL_DIR}/references/implementation-guide.md)

Security Checklist

API keys stored in secrets manager
API keys rotated every 90 days
Webhook signatures verified
PII sanitized before sending
Minimum necessary data sent
Team access follows least-privilege
Audit logging enabled
GDPR/CCPA deletion process documented
SSL/TLS enforced for all API calls

Error Handling

Issue	Solution
Exposed credentials	Rotate immediately, audit access
PII leak	Delete from Customer.io, notify DPO
Unauthorized access	Review access logs, revoke access

Resources

Next Steps

After implementing security, proceed to customerio-prod-checklist for production readiness.

Output

Configuration files or code changes applied to the project
Validation report confirming correct implementation
Summary of changes made and their rationale

See security implementation details for output format specifications.

Examples

Basic usage: Apply customerio security basics to a standard project setup with default configuration options.

Advanced scenario: Customize customerio security basics for production environments with multiple constraints and team-specific requirements.

customerio-security-basics