Fail closed before storage
Endpoints require a current organization key. If encryption is unavailable, requests with payload bodies are rejected rather than stored unencrypted.
Security
Your webhooks carry secrets.
We built accordingly.
Security is part of HookDeploy’s request path—not a policy layered on afterward. Payloads are sanitized, encrypted with organization-scoped keys, stored in your selected region, and released only through authenticated, permission-checked paths.
- Payload encryption
- AES-256-GCM
- Data encryption keys
- Per-org
- Key rotation schedule
- weekly
- Persistence regions
- 4
Protection path
One request. Multiple trust boundaries.
A webhook is treated as untrusted input from the moment it arrives. Each transition adds a separate control before data can move forward.
01 · Accept
Untrusted input
Token and IP rules run before capture. Payload-size and plan limits are enforced at the edge.
request admitted 02 · Minimize
Redact before storage
Common credential headers are replaced. Configured JSON fields are removed from the stored copy.
credentials removed 03 · Protect
Encrypt or reject
The organization key encrypts payload content. If that key is unavailable, a body is not stored.
AES-256-GCM 04 · Persist
Regional ciphertext
Encrypted blobs and protected structured fields persist in the organization’s selected region.
stored encrypted Authorized release path authenticated session organization membership role permission decrypt on demand
Encryption
A separate key boundary for every organization.
HookDeploy uses envelope encryption so customer payloads do not share one universal data key. Rotation changes the active key without breaking access to retained history.
Organization encryption boundary
AC
Acme Productionorganization boundary
current key ready Regional wrapping key Platform secret boundary Never stored beside payload data
wraps
Organization data key DEK · current Rotates on a weekly schedule
encrypts
bodyciphertext
headersencrypted
queryencrypted
Historical reads
request → original key id → authorized decrypt Sensitive headers redacted
Common credential headers are replaced before storage by default. An organization admin can disable header sanitization per endpoint; that change is audited.
Keys and access scoped by organization
Per-organization encryption keys work alongside role-based permissions, service authorization, and Postgres Row Level Security.
Plain-language scope: Authorized platform services decrypt payloads for requested product operations. Human support staff have no standing access; inspection requires an explicit, expiring customer grant. This is not zero-knowledge encryption.
Access isolation
Authorization is checked at more than one layer.
Organization membership starts the decision. Role permissions, service authorization, Row Level Security, and the payload key boundary complete it.
Requesting identity
AK
Ada K.authenticated session
- Organization
- Acme Production
- Role
- developer
- Action
- requests.read
1
SessionIdentity verified
pass2
MembershipActive in organization
pass3
PermissionRole grants requests.read
pass4
Row policyOrganization scope matches
pass5
Payload keyOrganization key resolved
pass Authorized outcome
◇
Decrypt one payload
The stored object remains ciphertext. Only this authorized response receives decrypted content.
scope · org_acme / req_7f2a Five organization roles Hashed API and endpoint keys Permission-gated audit history See the role matrix →
Human access
Support cannot read your payloads until you open the door.
HookDeploy is not zero knowledge: platform services decrypt data for authorized product operations. Human support access is different—it is locked by default and controlled by your organization.
Normal state
No standing support access
HookDeploy support tooling cannot inspect your organization’s payloads without an active grant from one of your organization administrators.
01
→ You grant accessAn org admin confirms temporary read-only access.
02
→ Support diagnosesAuthorized reads are recorded in audit history.
03
Access closesYou revoke it, or the grant expires automatically.
Customer-controlled boundary Read only
Default posture Locked
Support staff have no standing access to inspect organization payloads.
Customer decision Explicit grant
An organization admin must deliberately grant temporary, read-only support access.
Time boundary 24h · 48h · 7d
Every grant expires automatically and can be revoked by the customer at any time.
Accountability Audited
Grant, revocation, and support data-read events are recorded in organization audit history.
Close to zero knowledge, without sacrificing support. Encryption minimizes routine human access while this explicit grant path preserves the ability to help when you ask us to investigate.
Shared responsibility
Strong defaults. Explicit controls.
HookDeploy protects stored data by default, while giving your team control over who can send, what is retained, and where it persists.
HookDeploy protects On by default
01
Encrypt before persistencePayload content reaches storage as ciphertext.
platform02
Redact common credentialsHeader sanitization is enabled by default. An org admin can disable it per endpoint when required; the change is audited.
default · optional03
Keep organization boundariesKeys, roles, policies, and storage references retain organization scope.
platform04
Purge expired request dataDaily retention jobs remove expired records and associated payload objects.
platform Your team controls Configured by you
Endpoint access
Secret tokens
Require a high-entropy token on incoming requests. Only a SHA-256 hash is stored.
→ Network accessIP allowlists
Restrict production endpoints to known IPv4 addresses and CIDR ranges.
→ Payload privacyBody-field redaction
Remove selected sensitive JSON fields before the encrypted payload is stored.
→ Data lifecycleRegion and retention
Choose a persistence region and a plan-based request retention window.
→Signature headers are preserved for downstream verification even while default credential-header sanitization is enabled.
Data governance
Global at the edge. Regional at rest.
Cloudflare accepts traffic near the sender. Persistent payloads, metadata, and audit archives follow the organization region selected at signup.
Persistence boundary Selected per organization
CF
Global edge processingaccept · check · sanitize · encrypt
300+ locations US United States US persistence
EU European Union EU-jurisdiction object storage
AP Asia Pacific APAC persistence
AU Australia AU persistence
Edge execution location and persistence region are different concepts. Your selected region controls durable storage.
Data does not linger indefinitely.
Request retention follows your plan. A daily purge removes expired records and their associated encrypted objects.
Free · 7d Starter · 30d Team · 90d Enterprise · 365d
Significant changes leave history.
Member, endpoint, API-key, forwarding, and security-setting actions are written to an organization audit log and archived to regional object storage.
Cleanup crosses storage layers.
Account deletion orchestrates removal of database records and stored payload objects, with cleanup steps tracked for operational follow-up.
Secure delivery
Public HTTPS or private handoff.
Every saved public destination requires HTTPS. Team and Enterprise organizations can instead route the final handoff through Tailscale to a server with no public IP.
Standard pathHTTPS
HookDeploy edgeencrypted payload read
→ Your public endpointvalid TLS certificate
Available on every plan. Destination validation requires an https:// URL.
Private path · Team+Tailscale
HookDeploy edgeauthenticated handoff
→ Private relaynearest selected region
→ Your tailnetno public IP
The customer-facing server needs no inbound public firewall rule or open internet port.
Relay choices
Los AngelesUS West · CA
NewarkUS East · NJ
LondonEU West · UK
FrankfurtEU Central · DE
SingaporeAPAC · SG
SydneyAPAC · AU
Assurance
Controls first. Certification follows.
We designed the platform around auditability, access boundaries, key management, and repeatable data handling before beginning a formal certification process.
Current status · not certified
SOC 2 readiness was an architectural input—not a retrofit.
HookDeploy is not currently SOC 2 certified. We plan to begin a formal SOC 2 audit engagement by the end of 2026. Until then, we describe only controls that are implemented and evidenced in the product today.
Control ledgerImplemented today
Encryption and key lifecycleoperational
Organization roles and row policiesoperational
Security-setting audit historyoperational
Regional persistence and retentionoperational
Private-network deliveryoperational
Independent SOC 2 examinationplanned · 2026
CF
Built on Cloudflare’s global network. HookDeploy inherits Cloudflare’s edge platform and network-level DDoS mitigation. Customer payload persistence remains governed by HookDeploy’s regional storage and encryption controls.
Security FAQ
Direct answers for your review.
The same answers below are used for structured data so search engines, answer engines, and customers receive one version of the truth.
How does HookDeploy encrypt webhook data?
HookDeploy encrypts captured request bodies with AES-256-GCM before object storage. Headers, query parameters, and configured response content are encrypted before database storage. Each organization has its own data encryption key, wrapped by a regional master key and rotated on a weekly schedule.
Does HookDeploy store webhook payloads in plaintext?
Captured payload content is encrypted before storage. Operational metadata such as method, timestamp, source IP, and payload size is stored separately so HookDeploy can route, meter, and audit requests. HookDeploy is not a zero-knowledge service: authorized platform services decrypt payloads for requested product operations, but support staff have no standing payload access.
Can HookDeploy support staff read my payloads?
Not by default. Support staff can inspect organization payloads only after an organization admin explicitly grants temporary, read-only access through HookDeploy’s break-glass support system. Grants expire after 24 hours, 48 hours, or 7 days, can be revoked at any time, and produce audit events when granted, revoked, or used to read data.
How is data isolated between organizations?
HookDeploy combines per-organization encryption keys with role-based permissions, service-layer authorization, and Postgres Row Level Security. These independent controls reduce the impact of a failure in any one layer and keep customer access scoped to organization membership and permissions.
Does HookDeploy verify provider signatures?
HookDeploy preserves common HMAC signature headers so your destination can verify webhook authenticity. HookDeploy also supports verification handshakes for Meta, Slack, and Zoom on eligible plans. It does not claim universal provider-signature verification at ingestion.
Can HookDeploy deliver webhooks without a public server?
Yes. Team and Enterprise plans can route delivery through Tailscale to a private server with no public IP or inbound firewall port. Standard public forwarding requires an HTTPS destination.
Where is webhook data stored?
Webhook traffic is accepted on Cloudflare's 300+ location network. Persistent payload and metadata storage follows the organization region selected at signup: United States, European Union, Asia Pacific, or Australia.
Is HookDeploy SOC 2 certified?
Not yet. HookDeploy was designed with SOC 2 readiness in mind rather than treating controls as a later add-on. We plan to begin a formal SOC 2 audit engagement by the end of 2026 and will update this page as that work progresses.
How can I ask a security or trust question?
Email support@hookdeploy.dev. We can help with architecture, data handling, private delivery, and security-review questions.
Start capturing
Never lose a webhook again.
Free forever for solo devs. Point your first source at HookDeploy and watch it land in under a minute.
No credit card · 5,000 requests/mo free · Cancel anytime