impact.com Customer Email Hashing Explained
Last updated
impact.com applies HMAC hashing to user identifiers you send us to safeguard your customers' personal information and prevent fraudulent network use. This means that regardless of whether you send a raw value, a SHA-1 hash, or an HMAC value, impact.com will always store and return the HMAC hashed version.
Send a lowercase, trimmed, SHA-1 or SHA-256 hash of your customer's email address, not the raw (plaintext) email address.
Additional HMAC hashing is applied to values you send us in the following fields.
customerEmail, customerEmailSha256
customerEmail, customerEmailSha256
Note: If you have an Advocate program and want to use custom, non-email identifiers, then you can request that additional hashing be turned off. However, turning it off will result in reduced functionality for your program. Reach out to our support team if you have any questions.
impact.com accepts either a SHA-1 hash (customerEmail) or a SHA-256 hash (customerEmailSha256) of the customer's email. Before hashing, you must lowercase and trim the email address to ensure a consistent match. Sending the raw, unhashed email address is not recommended.
The additional hashing doesn't affect your implementation with impact.com. However, keep in mind the following when calling endpoints:
For GET endpoints, the response will include the HMAC hashed value for the customerEmail, customerEmailSha256, userId, and accountId instead of the value you originally sent us.
For creation and retrieval endpoints, including upsert and lookup actions, you can send any of the following values for the fields:
The original ID value you sent us.
The SHA-1 hashed value (customerEmail).
The SHA-256 hashed value (customerEmailSha256).
The HMAC value.
Last updated
