Security

This page answers the security questions an IT or security team asks before approving an integration with the Tepez API: how traffic is encrypted, which certification Tepez holds, where the data is hosted, and what each credential and link gives access to.

HTTPS only

The API accepts requests over HTTPS only. A request over plain HTTP isn't redirected: it's refused with 403 and an HTML page, before it reaches the API.

curl -i http://api.tepez.co.il/v1.0/me

The response, trimmed:

HTTP/1.1 403 Forbidden
Server: CloudFront
Content-Type: text/html

<H1>403 ERROR</H1>
<H2>The request could not be satisfied.</H2>

A key sent over plain HTTP crosses the network unencrypted, even though the request fails. If your code ever sent a key to an http:// address, treat the key as leaked: create a new one and revoke the old one, as Authentication describes.

Every HTTPS response carries a Strict-Transport-Security (HSTS) header, which tells browsers to use only HTTPS with the API and its subdomains for 2 years:

strict-transport-security: max-age=63072000; includeSubDomains; preload

ISO 27001

Tepez is certified to ISO/IEC 27001, the international standard for information security management. You can download the certificate from our security page (in Hebrew).

Where the data is hosted

The Tepez API runs on Amazon Web Services (AWS), in the eu-west-1 region (Ireland). The API, the database that holds your forms and entries, and the uploaded files and PDFs are all hosted there.

API keys are account-wide

An API key acts as the user who created it, and every user of an account has the same permissions. So a key can read and change all the forms and entries of your account. Keys have no scopes, so there is no read-only key and no key limited to one form, and keys don't expire.

Treat a key like a password: keep it in a secret manager, use it only from your servers, and create one key per integration so you can revoke one without stopping the others. Keeping your key safe has the full list.

No IP allowlisting

The API doesn't restrict callers by IP address. You can't limit a key to your servers' addresses, so anyone who holds a key can use it from anywhere. The key itself is the protection: keep it secret, and revoke it as soon as it may have leaked.

Access without an API key

Some access needs no key, by design. Take it into account when you plan an integration:

• Listing and exporting your account's entries always need a key (or a login token). Without one, the API answers 401 Missing authentication.
• Fill links (resumeUrlBewit) open one draft entry without signing in. Anyone who has the link can see and change that draft until it's submitted. Send each link only to the person it's for. See Links for form fillers.
• Download links of archived PDFs, exports and rendered PDFs need no key. Anyone who has one can download the file until the link expires (see Limits). Keep them inside your systems.
• A public form can be filled and submitted by anyone who has its link, and so can POST /entry/submit be called without a key. See With or without an API key.

Security questionnaires

Does your organization need a security questionnaire filled in, or have a question this page doesn't answer? Send it to us.