Log in Coming soon
Start for €1 + VAT Coming soon
No. HawkOpen has no independent security certification or audit report yet, and it does not claim one. An independent security assessment is still an open step before full release.
Checked:
What you can check yourself instead: evidence reports carry an Ed25519 signature that anyone can verify against HawkOpen’s published public key, and file uploads stay closed until external malware scanning is switched on.
HawkOpen is in a controlled launch, and no assessment will be named here before one has actually taken place.
HawkOpen encrypts its application secrets, such as access to connected mailboxes, and stored document files with AES-256-GCM. Production key management is still an open step before full release.
HawkOpen’s application code keeps each account’s data separate, so another customer’s account does not show your messages, events or documents. Separation at database level is still an open step before full release.
Because Google offers only one permission for IMAP and SMTP, and it covers the whole mailbox. HawkOpen uses that connection to send your emails, detect replies and show your mail in its inbox; Outlook connects with IMAP and SMTP permissions.
A tracking pixel is an ordinary tiny image, so loading it does not run code on your device. The risk is to privacy, not to security: it tells the sender that the image was loaded.
Every uploaded file must pass an external malware scan before HawkOpen stores it, and without that scanning service HawkOpen refuses uploads. The scanning service is not switched on yet, so PDF, video and e-signature uploads are refused for now.
With a one-time code: HawkOpen sends an 8-digit code to the recipient’s email address, valid for 10 minutes. In production a PDF, video or signing link always asks for it before the document opens; a proposal link asks for it before opening only when you switch on email verification, and always before the client accepts, signs or takes another action.
Yes. On the Business plan each webhook delivery carries an X-HawkOpen-Signature header, an HMAC signature made with your endpoint’s secret, so your server can check that the message came from HawkOpen and was not changed.
You sign in with your email address and password, or with a passkey that you have added in your account. HawkOpen has no separate code from an authenticator app or text message; a passkey is the stronger option.
If you forgot your password, use “Forgot password” on the sign-in page: HawkOpen emails a reset link that works for one hour. If you can no longer use the email address of the account, write to HawkOpen through the contact details on its Terms / Imprint page.
Yes. Your account settings list your own signed-in sessions, and you can sign out the ones you do not recognise. To change a password you have forgotten or want to replace, use the reset link from the sign-in page.
HawkOpen allows at most 10 sign-in attempts in 5 minutes from one network, and after 5 wrong passwords in a row it locks the account for 15 minutes. A locked account gets the same answer as a wrong password, so an attacker cannot tell the difference.
Yes. HawkOpen’s server sends a content security policy with its responses: data responses allow no content and no framing, and pages run only scripts and styles marked with a one-time value for that response.
For campaigns, yes. Before a campaign goes out HawkOpen runs a content check: it blocks a campaign with a valid payment card number or an executable or macro attachment, and it warns about things such as a national ID number, which you can then confirm. A single email sent from the dashboard or the browser extension is not checked.
Not as standard features yet. Company single sign-on (SAML or OIDC) and SCIM user provisioning are not switched on in HawkOpen, and there is no published audit-log view for team administrators.
Write to HawkOpen through the contact details on its Terms / Imprint page. HawkOpen has not published a formal disclosure policy or a bug bounty programme yet.