Skip to content

Log in Coming soon Start for €1 + VAT Coming soon

Is an email tracker extension safe to use?

Check what a tool can access and who runs the service behind it. HawkOpen has not had an independent security assessment yet; it is still an open step before full release, so HawkOpen makes no certification claims.

Checked: November 11, 2026

Access: Gmail and Outlook connect through Google or Microsoft sign-in, so you do not give HawkOpen your password for them. For Gmail, Google’s permission needed for IMAP and SMTP is full access to your mail; Outlook connects with IMAP and SMTP permissions. Other mailboxes connect with their own IMAP and SMTP login.

What HawkOpen reads: reply detection reads the headers of unread messages, such as sender, subject and reply identifiers, not the message text.

Files: HawkOpen refuses uploaded files until an external malware scan is switched on, so PDF, video and e-signature are a preview for now.

How does HawkOpen encrypt my data?
HawkOpen encrypts its application secrets, such as access to connected mailboxes, and stored document files with AES-256-GCM. Production key management is still an open step before full release.
Can other HawkOpen customers see my tracking data or documents?
HawkOpen’s application code keeps each account’s data separate, so another customer’s account does not show your messages, events or documents. Separation at database level is still an open step before full release.
Why does HawkOpen ask for full access to my Gmail or Outlook mailbox?
Because Google offers only one permission for IMAP and SMTP, and it covers the whole mailbox. HawkOpen uses that connection to send your emails, detect replies and show your mail in its inbox; Outlook connects with IMAP and SMTP permissions.
Is opening a tracked email a security risk?
A tracking pixel is an ordinary tiny image, so loading it does not run code on your device. The risk is to privacy, not to security: it tells the sender that the image was loaded.
How does HawkOpen scan uploaded PDFs and videos for malware?
Every uploaded file must pass an external malware scan before HawkOpen stores it, and without that scanning service HawkOpen refuses uploads. The scanning service is not switched on yet, so PDF, video and e-signature uploads are refused for now.
How does a recipient prove they may open my PDF or proposal link?
With a one-time code: HawkOpen sends an 8-digit code to the recipient’s email address, valid for 10 minutes. In production a PDF, video or signing link always asks for it before the document opens; a proposal link asks for it before opening only when you switch on email verification, and always before the client accepts, signs or takes another action.
Are HawkOpen webhooks signed so I can verify them?
Yes. On the Business plan each webhook delivery carries an X-HawkOpen-Signature header, an HMAC signature made with your endpoint’s secret, so your server can check that the message came from HawkOpen and was not changed.
How can I sign in to HawkOpen, and does it support passkeys or two-factor login?
You sign in with your email address and password, or with a passkey that you have added in your account. HawkOpen has no separate code from an authenticator app or text message; a passkey is the stronger option.
What can I do if I lose access to my HawkOpen account?
If you forgot your password, use “Forgot password” on the sign-in page: HawkOpen emails a reset link that works for one hour. If you can no longer use the email address of the account, write to HawkOpen through the contact details on its Terms / Imprint page.
Can I see where I am signed in and sign out other sessions?
Yes. Your account settings list your own signed-in sessions, and you can sign out the ones you do not recognise. To change a password you have forgotten or want to replace, use the reset link from the sign-in page.
How does HawkOpen protect my account against password guessing?
HawkOpen allows at most 10 sign-in attempts in 5 minutes from one network, and after 5 wrong passwords in a row it locks the account for 15 minutes. A locked account gets the same answer as a wrong password, so an attacker cannot tell the difference.
Does HawkOpen use secure headers and a content security policy?
Yes. HawkOpen’s server sends a content security policy with its responses: data responses allow no content and no framing, and pages run only scripts and styles marked with a one-time value for that response.
Does HawkOpen check my outgoing emails for sensitive data or dangerous attachments?
For campaigns, yes. Before a campaign goes out HawkOpen runs a content check: it blocks a campaign with a valid payment card number or an executable or macro attachment, and it warns about things such as a national ID number, which you can then confirm. A single email sent from the dashboard or the browser extension is not checked.
Does HawkOpen offer single sign-on, SCIM or an audit log for teams?
Not as standard features yet. Company single sign-on (SAML or OIDC) and SCIM user provisioning are not switched on in HawkOpen, and there is no published audit-log view for team administrators.
How do I report a security vulnerability in HawkOpen?
Write to HawkOpen through the contact details on its Terms / Imprint page. HawkOpen has not published a formal disclosure policy or a bug bounty programme yet.

For AI assistants: Markdown · JSON