Reference
Security
How signing secrets, credentials, and access are protected today, stated plainly — including what's still on the roadmap rather than overstating where things stand.
Secrets at rest
Signing secrets & endpoint auth credentials Live
Encrypted at rest using envelope encryption (AES-256-GCM): each secret has its own per-record data key, itself wrapped by a key-encryption key. No plaintext signing secret or credential is ever stored — the raw value exists only transiently in memory when it's generated or used.
API keys Live
Stored as a SHA-256 hash, never plaintext. The full key is shown to you exactly once, at creation or rotation — after that, not even we can retrieve it, only verify a presented key against the stored hash.
Custom delivery headers Plain text, by design
Unlike the two above, custom static delivery headers are stored in plain text — this field is explicitly for non-secret data, and the dashboard warns against putting credentials there. Use Endpoint Auth for anything that needs encryption.
In transit
Outbound deliveries are HTTPS-only
Plain HTTP endpoints are rejected outright — see Endpoint Verification & URLs.
Every delivery is signed
HMAC-SHA256 over the Standard Webhooks spec — see Signature Verification for the full recipe.
Access control
Authentication
Dashboard access is via Google SSO or Clerk — no username/password combinations to leak or brute-force.
Three-tier role model
Org Admin, Monitor (read-only), and Super Admin — see Roles & Access.
Multi-tenant isolation
Every resource is scoped to an organization; cross-org access attempts return the same "not found" response as a genuinely nonexistent resource — no way to distinguish "exists but not yours" from "doesn't exist."
Outbound request protection (SSRF)
Endpoint URLs are checked against a private/loopback/link-local address blocklist before anything is sent — see Endpoint Verification & URLs.
What's on the roadmap, not live yet
Stated plainly rather than implied — none of the below should be assumed available today.
| Item | Status |
|---|---|
| SOC 2 | No formal program underway yet. |
| GDPR / EU data residency | Not yet built — regional data residency is future scoped work. |
| SSO/SAML for enterprise dashboard login | Not yet available. |
| Formal audit logs | Not yet built as a dedicated feature (individual actions do carry a "who did this" attribution in places like Pause History and API key creation, but there's no unified audit log product yet). |
If data control matters more than a managed dashboard for your compliance posture,
the platform is also self-hostable — running it entirely on your own infrastructure sidesteps
several of the "not yet" items above by keeping everything within your own environment.