impact.com Customer Email Hashing Explained

impact.com applies HMAC hashing to user identifiers you send us to safeguard your customers' personal information and prevent fraudulent network use. This means that regardless of whether you send a raw value, a SHA-1 hash, or an HMAC value, impact.com will always store and return the HMAC hashed version.

Send a lowercase, trimmed, SHA-1 or SHA-256 hash of your customer's email address, not the raw (plaintext) email address.

Where does the hashing apply?

Additional HMAC hashing is applied to values you send us in the following fields.

Method	Field
UTT	customerEmail, customerEmailSha256
Conversions API	customerEmail, customerEmailSha256
Advocate REST API and GraphQL	userId and accountId

Note: If you have an Advocate program and want to use custom, non-email identifiers, then you can request that additional hashing be turned off. However, turning it off will result in reduced functionality for your program. Reach out to our support team if you have any questions.

Which hash should I send?

impact.com accepts either a SHA-1 hash (customerEmail) or a SHA-256 hash (customerEmailSha256) of the customer's email. Before hashing, you must lowercase and trim the email address to ensure a consistent match. Sending the raw, unhashed email address is not recommended.

How does this affect data I send to impact.com?

The additional hashing doesn't affect your implementation with impact.com. However, keep in mind the following when calling endpoints:

• For GET endpoints, the response will include the HMAC hashed value for the customerEmail, customerEmailSha256, userId, and accountId instead of the value you originally sent us.
• For creation and retrieval endpoints, including upsert and lookup actions, you can send any of the following values for the fields:

  • The original ID value you sent us.
  • The SHA-1 hashed value (customerEmail).
  • The SHA-256 hashed value (customerEmailSha256).
  • The HMAC value.