API & Third-Party Integration Policy
Effective Date: September 14, 2026
This Policy establishes requirements for the design, approval, operation, security, privacy, and lifecycle management of APIs and third-party integrations used by Efferent.
1. Purpose
This Policy establishes requirements for the design, approval, operation, security, privacy, and lifecycle management of APIs and third-party integrations used by Efferent.
2. Scope
The Policy applies to inbound and outbound APIs, OAuth connections, webhooks, messaging providers, social-media integrations, cloud services, authentication providers, analytics services, and other external systems exchanging data with Efferent.
3. Supported Integrations
Efferent may support integrations with SMS, WhatsApp, email, Facebook, Instagram, X, TikTok, LinkedIn, Twilio, and other approved providers. An integration is supported only to the extent authorized by the provider, applicable API scopes, Efferent product configuration, and contractual requirements.
4. Approval and Due Diligence
New integrations require risk-based technical, security, privacy, legal, and product review before production use. Review should address data categories, permissions, purpose, authentication, rate limits, platform terms, subprocessors, retention, security obligations, geographic restrictions, and termination requirements.
5. Least-Privilege Scopes
Efferent will request only API permissions reasonably necessary to provide enabled functionality. Product teams must document the business purpose for material scopes and remove obsolete scopes when no longer needed.
6. OAuth and Credential Security
API keys, secrets, tokens, signing keys, and refresh tokens must be protected using approved secrets-management controls and may not be hard-coded in source repositories. OAuth redirect URIs, token exchange, revocation, and refresh processes must follow provider requirements.
7. User Authorization
Where an integration requires user authorization, Efferent must provide an appropriate connection flow and process only information within the permissions granted. Users must be able to disconnect integrations where technically and contractually supported.
8. Data Use Restrictions
Data obtained through an API may be used only for authorized Efferent functionality and in accordance with the provider's terms, applicable law, the Efferent Privacy Policy, customer instructions, and contractual restrictions. API data must not be sold, repurposed, or disclosed in violation of applicable restrictions.
9. Non-Public U.S. User Data
Where Efferent receives non-public U.S. user data through an authorized integration, access will be limited to approved systems and personnel with a business need. Such data will be processed for authorized functionality, protected by appropriate safeguards, and retained only as necessary for the service, legal obligations, security, or contractual requirements.
10. Webhook Security
Webhook endpoints must use HTTPS and appropriate authentication or signature validation where supported. Systems should protect against replay, spoofing, malformed payloads, duplicate events, excessive retries, and unauthorized event injection.
11. Rate Limits and Resilience
Integrations must respect provider rate limits and usage restrictions. Engineering should implement appropriate retry, backoff, idempotency, queueing, circuit-breaking, monitoring, and failure-handling mechanisms to reduce service disruption.
12. Logging and Monitoring
Integration activity should be logged at a level appropriate for troubleshooting, security, and compliance without unnecessarily recording secrets or sensitive payloads. Material authentication failures, abnormal usage, webhook failures, and provider errors should be monitored.
13. Third-Party Terms
Efferent teams and customers must comply with applicable provider developer agreements, platform policies, acceptable-use requirements, branding rules, data-use restrictions, and review requirements. Provider terms may change and may require product modifications.
14. Customer Responsibilities
Customers are responsible for the legality of their connected accounts, content, communications, permissions, audience relationships, and use of integration functionality. Customers must not use Efferent to bypass platform restrictions or access data they are not authorized to access.
15. Privacy and Retention
API-derived Personal Information is subject to the Efferent Privacy Policy, applicable DPA, retention rules, deletion obligations, and provider-specific requirements. Where a provider requires deletion following revocation, account disconnection, or a user request, Efferent will implement applicable deletion workflows.
16. AI Use of API Data
API-derived data may be processed by AI features only where the use is consistent with customer instructions, provider terms, applicable law, Efferent's AI Governance Policy, and relevant contractual restrictions.
17. Vendor and Subprocessor Management
Third-party providers that process Customer Data on Efficion's behalf are subject to risk-based vendor review and appropriate contractual obligations concerning confidentiality, security, privacy, incident response, and data use.
18. Incident Response
Suspected compromise of an integration, credential, token, webhook, or API-derived data must be reported promptly. Efficion may revoke credentials, disable integrations, rotate secrets, suspend processing, or take other protective measures.
19. Deprecation and Change Management
Engineering must monitor material provider changes and plan for API version migrations, permission changes, deprecations, and discontinued functionality. Efferent may modify or discontinue an integration where required by a provider or where continued support presents unreasonable security, legal, or operational risk.
20. Enforcement and Exceptions
Violations may result in integration suspension, credential revocation, customer restrictions, disciplinary action, or termination of a vendor relationship. Exceptions require documented approval from appropriate Engineering, Security, Privacy, and/or ELCO stakeholders.
21. Review
This Policy should be reviewed at least annually and following material changes to Efferent integrations, applicable platform terms, law, or security requirements.