# Customerio Security Basics

> Apply Customer.io security best practices. Use when implementing secure integrations, handling PII, or setting up proper access controls. Trigger with phrases like "customer.io security", "customer.io pii", "secure customer.io", "customer.io gdpr".

- Skill: `micsapp/customerio-security-basics` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add micsapp/customerio-security-basics`
- Raw SKILL.md: https://api.skillmd.com/api/skills/micsapp/customerio-security-basics/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: micsapp (https://skillmd.com/u/micsapp)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/micsapp/customerio-security-basics

---

# Customer.io Security Basics

## Overview
Implement security best practices for Customer.io integrations including credential management, PII handling, webhook verification, and GDPR compliance.

## Prerequisites
- Customer.io account with admin access
- Understanding of your data classification
- Environment variable management

## Instructions

### Step 1: Set Up Secure Credential Management
Use a secrets manager (GCP Secret Manager, AWS Secrets Manager) instead of environment variables for production credentials.

### Step 2: Implement PII Data Handling
Hash sensitive identifiers with SHA-256 before sending. Sanitize user attributes to remove highly sensitive fields (SSN, credit card) and optionally hash PII fields (phone, address).

### Step 3: Configure API Key Rotation
Establish a 90-day rotation schedule. Automate through secrets manager where possible with zero-downtime rotation procedures.

### Step 4: Secure Webhook Endpoints
Verify Customer.io webhook signatures using HMAC-SHA256 with `crypto.timingSafeEqual`. Create Express middleware for automatic verification.

### Step 5: Implement Access Controls
Define role-based permissions (admin, editor, viewer) and enable audit logging for security-sensitive operations.

### Step 6: Handle Data Retention
Implement user suppression and deletion for GDPR/CCPA compliance. Create anonymization functions for historical analytics data.

For detailed implementation code and configurations, load the reference guide:
`Read(${CLAUDE_SKILL_DIR}/references/implementation-guide.md)`

## Security Checklist
- [ ] API keys stored in secrets manager
- [ ] API keys rotated every 90 days
- [ ] Webhook signatures verified
- [ ] PII sanitized before sending
- [ ] Minimum necessary data sent
- [ ] Team access follows least-privilege
- [ ] Audit logging enabled
- [ ] GDPR/CCPA deletion process documented
- [ ] SSL/TLS enforced for all API calls

## Error Handling
| Issue | Solution |
|-------|----------|
| Exposed credentials | Rotate immediately, audit access |
| PII leak | Delete from Customer.io, notify DPO |
| Unauthorized access | Review access logs, revoke access |

## Resources
- [Customer.io Security](https://customer.io/security/)
- [GDPR Compliance](https://customer.io/docs/gdpr/)
- [Suppression API](https://customer.io/docs/api/track/#operation/suppress)

## Next Steps
After implementing security, proceed to `customerio-prod-checklist` for production readiness.

## Output

- Configuration files or code changes applied to the project
- Validation report confirming correct implementation
- Summary of changes made and their rationale

See [security implementation details](${CLAUDE_SKILL_DIR}/references/implementation.md) for output format specifications.

## Examples

**Basic usage**: Apply customerio security basics to a standard project setup with default configuration options.

**Advanced scenario**: Customize customerio security basics for production environments with multiple constraints and team-specific requirements.