Security

Platform

• All traffic is TLS-only; HSTS is enforced across mute.sh, api.mute.sh, and grpc.mute.sh.
• We run our own Hyperliquid mainnet node and record data at the source — no third-party data intermediaries in the hot path.
• Data is reconciled against the chain block by block, so tampering or silent loss is detectable by construction — and auditable by you.

Keys & webhooks

• API keys are scoped per organization, revocable and rotatable instantly from the dashboard.
• Webhook deliveries are signed (X-HL-Signature, HMAC-SHA256) so your server can verify every event; secrets rotate on demand.
• Least-privilege internally: the ingest path is write-only into the store; serving reads through separate credentials.

Operations

• 24/7 monitoring with direct founder paging — the on-call rotation is the founding team.
• Error monitoring and alerting on every service; incidents are communicated to affected Enterprise customers directly.
• Off-site backups of the historical archive.

Reporting a vulnerability

Found something? Email admin@mute.sh with details. A founder reads every report — same-day acknowledgement for anything credible. Please give us reasonable time to fix before public disclosure.