Security

Last updated 2026-05-10

Posture

• TLS 1.2+ everywhere; HSTS enabled at the edge.
• Postgres encrypted at rest; daily snapshots with 30-day retention.
• API keys stored only as sha256(secret) + 8-char prefix; never recoverable.
• Webhook payloads signed (HMAC-SHA256) with per-subscription secrets.
• Per-API-key rate limits and optional IP allowlist.
• Visitor IP addresses anonymized at write time; no raw IPs persisted.

Service status

Live service status is on our status page, which checks the API, dashboard, and redirects in real time. We do not yet publish a historical uptime log or third-party audit report — we only claim what we can show.

Reporting a vulnerability

Please email [email protected] with details. We respond within 2 business days and will not pursue good-faith research.