Security is at the core of our culture and we have operated from a security-first mentality from day one.
Persona’s security philosophy follows three principles:
For more information about our security measures, see our Security Statement or contact us.
If you are calling our external API with static IP addresses and want an additional layer of security beyond API key based authorization, you can restrict the IPs that Persona accepts requests from. To add IP addresses to the allowlist, visit the API Key Configuration section within the Persona dashboard.
The full list of IP addresses that webhook and workflow requests may come from is:
If your organization has network security policies that require allowlisting external domains, you should include the following Persona domains to ensure proper functionality:
If you have configured a custom subdomain for your organization, you should also allowlist:
For information on how to set up a custom subdomain, see our Subdomains documentation.