Klaviyo app listing requirements

All sensitive data (e.g., passwords, financial information, PII, OAuth tokens) must be encrypted at rest using industry-standard algorithms (e.g., AES-256).

• Your app must authenticate and authorize requests on exposed endpoints.
• Your app must validate the application identity and integrity of the request.
• Your app must validate tokens server-side to ensure that only permitted users can execute actions within an application.
• Your app must have tokens that expire, and the application must reject expired tokens.
• At a minimum, ensure that MFA is required to authenticate to your app's systems and resources used to process, store and/or transmit data.
• Implement robust access controls (e.g., role-based access control) to limit access to data based on the application's specific needs.
• Clearly state where user data will be stored and processed. If data is transferred outside the user's region, obtain explicit user consent and comply with relevant data transfer regulations (e.g., GDPR).

• Store OAuth credentials securely using industry best practices, a dedicated credential store with encryption (e.g., AWS/GCP Secrets Manager, Vault, etc.). Restrict access to credential store(s) to only those individuals required for proper operation.
• Never hardcode OAuth client credentials within the application code. Always retrieve them from a secure secrets store (e.g. AWS/GCP Secrets Manager, Vault, etc.).
• Request only the minimum set of API permissions necessary for the application's functionality.
• Implement mechanisms for regular rotation of OAuth client credentials to mitigate the risk of compromise.

• Provide comprehensive and accurate API documentation that outlines available endpoints, authentication methods, and expected data formats.
• Implement rate limiting on API calls to prevent abuse attacks.
• Validate and sanitize all user input received through the API to prevent malicious code injection attacks (e.g., SQL injection, XSS).
• Implement secure error handling practices to avoid exposing sensitive information in error messages.
• Logging and auditing:
• Implement logging mechanisms that capture detailed records of activities, including login attempts, data access, changes, deletions, API calls, etc.
• Securely store logs in a tamper-evident manner to prevent unauthorized access or modifications.
• Logs must be retained for a minimum of 365 days.
• Ensure real-time monitoring of log data to detect and alert on suspicious or anomalous activities.

• The third-party application must validate and sanitize all untrusted data and treat all user input as unsafe.
• The third-party application must not use versions of third-party libraries and dependencies with known critical or high vulnerabilities. When vulnerabilities in these libraries and dependencies are discovered, application developers must remediate vulnerabilities in 3 and 7 days respectively.