Hourglass Content Intelligence
Website ↗
← All conversations

Conversation

22 Oct 2026, 10:06 UTC · 1 question · ID b9a78683cc80
Who asked
Persona
CIO (Chief Information Officer)
Company
Charles Schwab
Industry
Financial services
Pages visited (1)
  1. /platformQuestion 1 asked here
Question 1

“How do webhooks prove they come from you?”

Answer
Not answered

The site never mentions webhooks, so it does not say how a webhook proves it came from Hourglass. No signature header, signing secret or verification steps appear on /platform, /products/data or /security.

Section on the siteStatusTicket
/platformThe tools in Data HubMissing here
Add a webhooks and API section to /platform

Ticket

Paste this into your ticketing tool.

Add a webhooks and API section to /platform

Who needs it: Developers and IT teams building integrations (this visitor: CIO, Charles Schwab)
Section: /platform › The tools in Data Hub

What is missing:
- Webhooks are not mentioned anywhere on /platform.
- How a webhook proves it came from Hourglass (signature header, signing secret) is not described.
- The steps to verify a webhook signature are not given.

Where: New section on /platform, placed after "The tools in Data Hub".
  Related sections: Your data, connected and under control · Data syncs · Change history
  Main topics: Webhooks available and the events they send · How each webhook is signed · How receivers verify the signature · Rotating signing secrets · Retries and failed deliveries

What to do:
1. Confirm with engineering how webhooks are signed, which header carries the signature, how secrets are issued and rotated, and the verification method.
2. Add the section with an overview of webhook signing and verification, linking to developer documentation if it exists.

Done when: /platform has a section that explains how webhooks are signed and how a receiver verifies them.

From: conversation b9a78683cc80, question 1: "How do webhooks prove they come from you?"
Who needs it: Developers and IT teams building integrations (this visitor: CIO, Charles Schwab)
What is missing
  • Webhooks are not mentioned anywhere on /platform.
  • How a webhook proves it came from Hourglass (signature header, signing secret) is not described.
  • The steps to verify a webhook signature are not given.
Where
New section on /platform, placed after "The tools in Data Hub".
Related sections
Your data, connected and under control · Data syncs · Change history
Main topics
Webhooks available and the events they send · How each webhook is signed · How receivers verify the signature · Rotating signing secrets · Retries and failed deliveries
What to do
  1. Confirm with engineering how webhooks are signed, which header carries the signature, how secrets are issued and rotated, and the verification method.
  2. Add the section with an overview of webhook signing and verification, linking to developer documentation if it exists.
Done when: /platform has a section that explains how webhooks are signed and how a receiver verifies them.
/securitySecurity and control, built into every hubMissing here
Add webhook signing to the security controls on /security

Ticket

Paste this into your ticketing tool.

Add webhook signing to the security controls on /security

Who needs it: CTOs and IT or security reviewers checking a vendor
Section: /security › Security and control, built into every hub

What is missing:
- Webhook signature verification is not listed among the security controls.

Where: Update this section: add a card beside "Encryption" and "Single sign-on".

What to do:
1. Confirm with the security team how webhook signing works and whether it belongs among the listed controls.
2. Add a card on signed webhooks that links to the new webhooks section on /platform.

Done when: /security lists webhook signing as a control and links to how to verify it.
Depends on: Add a webhooks and API section to /platform

From: conversation b9a78683cc80, question 1: "How do webhooks prove they come from you?"
Who needs it: CTOs and IT or security reviewers checking a vendor
What is missing
  • Webhook signature verification is not listed among the security controls.
Where
Update this section: add a card beside "Encryption" and "Single sign-on".
What to do
  1. Confirm with the security team how webhook signing works and whether it belongs among the listed controls.
  2. Add a card on signed webhooks that links to the new webhooks section on /platform.
Done when: /security lists webhook signing as a control and links to how to verify it.
Depends on: “Add a webhooks and API section to /platform”
/products/dataTwo-way syncs, without custom code (card)Missing here
Mention signed webhooks in the syncs card on /products/data

Ticket

Paste this into your ticketing tool.

Mention signed webhooks in the syncs card on /products/data

Who needs it: IT and data teams setting up syncs
Section: /products/data › Two-way syncs, without custom code (card)

What is missing:
- Webhooks and how they are verified are not mentioned alongside syncs.

Where: Update this section: add a line to the "Two-way syncs, without custom code" card after "Read-only fields where you need them".

What to do:
1. Confirm with product that webhooks are part of Data Hub.
2. Add a line on signed webhooks with a link to the webhooks section on /platform.

Done when: /products/data mentions signed webhooks in the syncs card and links to the verification details.
Depends on: Add a webhooks and API section to /platform

From: conversation b9a78683cc80, question 1: "How do webhooks prove they come from you?"
Who needs it: IT and data teams setting up syncs
What is missing
  • Webhooks and how they are verified are not mentioned alongside syncs.
Where
Update this section: add a line to the "Two-way syncs, without custom code" card after "Read-only fields where you need them".
What to do
  1. Confirm with product that webhooks are part of Data Hub.
  2. Add a line on signed webhooks with a link to the webhooks section on /platform.
Done when: /products/data mentions signed webhooks in the syncs card and links to the verification details.
Depends on: “Add a webhooks and API section to /platform”
Answer full page
Each webhook carries a Hourglass-Signature header that you can check to confirm it really came from Hourglass. The docs section below walks through how to verify it.
Sections in the answer pageStatus
/platformThe tools in Data HubMissing here
/securitySecurity and control, built into every hubMissing here
/products/dataTwo-way syncs, without custom code (card)Missing here

Questions and answers are shown as recorded. Status, what is missing and what to do are our analysis of the live site, read 22 Oct 2026.