Security guidance
Email messages may contain personal, confidential, or regulated data. Treat the request body as sensitive throughout your integration.
Transport and credentials
- Use only
https://api.phishinghermes.comover valid TLS. - Validate certificates normally; do not disable hostname or chain verification.
- Keep API keys in a secrets manager and inject them only at runtime.
- Redact
X-API-Key, raw message bodies, attachments, and sensitive headers from logs and traces. - Rotate credentials after suspected exposure and contact Hermes operations.
Data minimization
Send only messages that your organization is authorized to process. Do not add customer IDs or personal data to idempotency keys, request IDs, filenames, query parameters, or log messages.
Use synthetic fixtures during development. The included sample message uses reserved example domains.
Network design
Call the API from a trusted backend, not browser or mobile code. Restrict outbound access where practical to the Hermes API hostname and port 443. Do not proxy the API key through untrusted analytics or observability services.
Response handling
Response fields are intentionally minimized, but analysis identifiers and security decisions can still be sensitive. Apply least privilege, retention controls, and audit logging to stored results.
Incident support
When reporting a problem, provide request_id, approximate UTC time, status, and problem code. Do not email the API key or full message unless a separately approved secure support procedure requires it.
This integration guide is not a security certification, data processing agreement, penetration-test report, or subprocessor list. Obtain the applicable contractual and assurance material from Hermes before processing production data.