# Boundaries that hold from send to embed

Repost applies security at the destination request, endpoint configuration,
customer session, and embedding boundaries.

## Signed delivery

Every outbound request is signed over its stable webhook ID, attempt timestamp,
and exact body. Repost refuses unsigned delivery when no signing secret is
available. Custom endpoint headers cannot replace protected identity,
signature, or content headers.

## Secret rotation

Customers can reveal active signing-secret versions and rotate to a new one.
An optional overlap window keeps the previous version available while the
consumer updates verification code.

## Tenant isolation

Portal sessions are scoped to one environment and customer. Endpoint,
subscription, delivery, attempt, and secret operations use that scope;
cross-customer resources are not returned.

## Embedding boundaries

Allowed origins constrain where the customer portal can be embedded. Read-only
sessions can render an accurate preview while blocking endpoint changes,
secret access, pause and resume, deletion, and replay.

## Continue

- [Review the customer portal controls](/product/customer-portals.md)
- [Understand signed sending](/product/send-webhooks.md)
- [Read Repost legal documents](/legal.md)