Security

Question 1

Is an email tracker extension safe to use?

Accepted Answer

Check what a tool can access and who runs the service behind it. HawkOpen has not had an independent security assessment yet; it is still an open step before full release, so HawkOpen makes no certification claims.

Question 2

Does HawkOpen have security certifications?

Accepted Answer

No. HawkOpen has no independent security certification or audit report yet, and it does not claim one. An independent security assessment is still an open step before full release.

Question 3

How does HawkOpen encrypt my data?

Accepted Answer

HawkOpen encrypts its application secrets, such as access to connected mailboxes, and stored document files with AES-256-GCM. Production key management is still an open step before full release.

HawkOpen does not present this as a certification. An independent security assessment and database-level separation of customers are also still open steps, and they will be named only once they are done.

Question 4

Can other HawkOpen customers see my tracking data or documents?

Accepted Answer

HawkOpen’s application code keeps each account’s data separate, so another customer’s account does not show your messages, events or documents. Separation at database level is still an open step before full release.

People outside HawkOpen open your shared documents only through their own link; in production a PDF, video or signing link also asks for an 8-digit code that HawkOpen sends to their email address, and a proposal link asks for it when you switch on email verification. No independent assessment has checked this separation yet.

Question 5

Why does HawkOpen ask for full access to my Gmail or Outlook mailbox?

Accepted Answer

Because Google offers only one permission for IMAP and SMTP, and it covers the whole mailbox. HawkOpen uses that connection to send your emails, detect replies and show your mail in its inbox; Outlook connects with IMAP and SMTP permissions.

Reply detection reads only the headers of unread messages, not their text. The browser extension works on the web pages of Gmail, Outlook and Yahoo Mail.

When you remove a mailbox in HawkOpen, HawkOpen also asks Google or Microsoft to withdraw its access. You can check and remove app access in your Google or Microsoft account settings at any time.

Question 6

Is opening a tracked email a security risk?

Accepted Answer

A tracking pixel is an ordinary tiny image, so loading it does not run code on your device. The risk is to privacy, not to security: it tells the sender that the image was loaded.

Real dangers in email usually come from attachments and links from people you do not know, not from opening the message. HawkOpen tracks a recipient only with that recipient’s consent for the sending company; a tracked email ends with the notice “This message contains HawkOpen tracking elements.” and the link “Do not track my activity”, which refuses tracking by that company as soon as the recipient opens it. Switching off automatic image loading in your mail app also stops tracking images. The notice and a later opt-out do not replace consent.

Where rules that require consent apply, tracking may start only after that consent has been obtained. The link in the message lets the recipient withdraw consent later.

Question 7

How does HawkOpen scan uploaded PDFs and videos for malware?

Accepted Answer

Every uploaded file must pass an external malware scan before HawkOpen stores it, and without that scanning service HawkOpen refuses uploads. The scanning service is not switched on yet, so PDF, video and e-signature uploads are refused for now.

The same check guards PDF links, proposals, video and e-signature, so none of them accepts files until the scanning service is connected and reviewed. That is why these features are still a preview.

Question 8

How does a recipient prove they may open my PDF or proposal link?

Accepted Answer

With a one-time code: HawkOpen sends an 8-digit code to the recipient’s email address, valid for 10 minutes. In production a PDF, video or signing link always asks for it before the document opens; a proposal link asks for it before opening only when you switch on email verification, and always before the client accepts, signs or takes another action.

This shows that the person can read that mailbox, so a forwarded link alone does not open a document that asks for the code. You can also give a link an expiry date and a limit on views.

Question 9

Are HawkOpen webhooks signed so I can verify them?

Accepted Answer

Yes. On the Business plan each webhook delivery carries an X-HawkOpen-Signature header, an HMAC signature made with your endpoint’s secret, so your server can check that the message came from HawkOpen and was not changed.

Webhooks report events such as opens, clicks, replies, bounces, unsubscribes and due reminders. Keep the endpoint secret private, and reject any delivery whose signature does not match.

Question 10

How can I sign in to HawkOpen, and does it support passkeys or two-factor login?

Accepted Answer

You sign in with your email address and password, or with a passkey that you have added in your account. HawkOpen has no separate code from an authenticator app or text message; a passkey is the stronger option.

A passkey uses your device’s fingerprint, face or screen lock instead of a password, and you can remove a passkey from your account later. Repeated wrong passwords are slowed down and can lock the account for a while.

Question 11

What can I do if I lose access to my HawkOpen account?

Accepted Answer

If you forgot your password, use “Forgot password” on the sign-in page: HawkOpen emails a reset link that works for one hour. If you can no longer use the email address of the account, write to HawkOpen through the contact details on its Terms / Imprint page.

Add a passkey while you still have access: it lets you sign in without the password.

Question 12

Can I see where I am signed in and sign out other sessions?

Accepted Answer

Yes. Your account settings list your own signed-in sessions, and you can sign out the ones you do not recognise. To change a password you have forgotten or want to replace, use the reset link from the sign-in page.

If you see a session you do not recognise, sign it out, then set a new password and check the passkeys in your account.

Question 13

How does HawkOpen protect my account against password guessing?

Accepted Answer

HawkOpen allows at most 10 sign-in attempts in 5 minutes from one network, and after 5 wrong passwords in a row it locks the account for 15 minutes. A locked account gets the same answer as a wrong password, so an attacker cannot tell the difference.

If you are locked out, wait 15 minutes or reset your password. A passkey avoids password guessing altogether.

Question 14

Does HawkOpen use secure headers and a content security policy?

Accepted Answer

Yes. HawkOpen’s server sends a content security policy with its responses: data responses allow no content and no framing, and pages run only scripts and styles marked with a one-time value for that response.

No external test result of these headers is published, and an independent security assessment is still an open step before full release.

Question 15

Does HawkOpen check my outgoing emails for sensitive data or dangerous attachments?

Accepted Answer

For campaigns, yes. Before a campaign goes out HawkOpen runs a content check: it blocks a campaign with a valid payment card number or an executable or macro attachment, and it warns about things such as a national ID number, which you can then confirm. A single email sent from the dashboard or the browser extension is not checked.

The check looks for known patterns only; it is not a guarantee that nothing sensitive leaves your mailbox. If a campaign is blocked, remove the card number or the attachment and create it again.

Question 16

Does HawkOpen offer single sign-on, SCIM or an audit log for teams?

Accepted Answer

Not as standard features yet. Company single sign-on (SAML or OIDC) and SCIM user provisioning are not switched on in HawkOpen, and there is no published audit-log view for team administrators.

HawkOpen does keep security and audit records as part of running the service, as its privacy page says. Each person on a team signs in with their own email and password or passkey.

Question 17

How do I report a security vulnerability in HawkOpen?

Accepted Answer

Write to HawkOpen through the contact details on its Terms / Imprint page. HawkOpen has not published a formal disclosure policy or a bug bounty programme yet.

Describe the problem, the steps to reproduce it and what you could reach. Please do not access other people’s data or disrupt the service while testing.