Security review kit
Everything your security team asks before approving Webhook Relay: how traffic reaches your network, what we store and for how long, who can access it, and the SOC 2 Type II report.
We reply within one business day. Annual plans can be paid by invoice and purchase order.
Compliance
SOC 2 Type II
- Independently audited security controls.
- The SOC 2 Type II report is available to customers and prospects on request.
- Help with security questionnaires and vendor onboarding paperwork.
Network
How traffic reaches your network
- Agents, the Kubernetes operator and the Jenkins plugin connect out. Nothing connects in, so no inbound port or public IP is needed.
- All connections use TLS, so traffic is encrypted in transit.
- The agent protocol only carries HTTP requests, so even a compromised account can't reach SSH or other services.
- Forwarding is one-way by default: senders never see your servers' responses.
Data
What we store, and for how long
- Each webhook's body, headers and destination are stored for delivery logs, retries and replay.
- Webhook data is encrypted with AES-256 at rest.
- Data is kept for your plan's retention period and then deleted automatically.
- Ephemeral buckets never store bodies, headers or query strings: only status code and time.
- A self-hosted version keeps every payload on your own servers.
Access
Who can reach your data
- Only the account owner and the team members or sub-accounts they create can access webhook data.
- Passwords and token secrets are stored as one-way hashes.
- Access tokens can be limited by API role and by which buckets they subscribe to.
- SAML SSO, role-based access and an audit log of every change.
Senders
Only trusted webhooks are forwarded
- HMAC signatures checked by a function on the input, before forwarding.
- JWT verification, basic auth and HTTP method filters on inputs.
- Source IP allowlists: up to 20 addresses or CIDR ranges per input, on Business and above.
- Rejected requests never reach your agent or network, and stay visible in the logs.
Infrastructure
Where it runs
- Webhook Relay runs on Google Cloud's Kubernetes platform for high availability.
- Infrastructure and payment providers are listed in the privacy policy.
- Webhooks are retried for up to 30 days with durable delivery.
- Operated by Appscension Ltd, a UK company.
Answers for your questionnaire
The questions security teams ask most. Send us yours and we'll fill it in.
Do we need to open inbound ports or expose a public IP?
No. The relay agent, the Kubernetes operator and the Jenkins plugin open an outbound connection to Webhook Relay over TLS, and webhooks are delivered over that connection. Nothing connects in to your network.
Is data encrypted in transit and at rest?
Yes. All connections use TLS, and webhook data is encrypted with AES-256 at rest.
What data do you store, and can we turn that off?
For each webhook we store the body, headers and destination for delivery logs, retries and replay. It is deleted automatically when your plan's retention period ends. Ephemeral buckets store no body, headers or query strings at all, only the status code and time.
Who at Webhook Relay can see our webhooks?
Webhook data can only be accessed by the account owner and the team members or sub-accounts the owner creates.
Could a compromised Webhook Relay account be used to reach our servers?
The agent protocol only carries HTTP requests to the destinations you configure, so it can't be used to open SSH or other connections into your network. Agents also can't be switched between webhook forwarding and tunnel mode through the API.
Can we restrict which IP addresses can send webhooks to our endpoints?
Yes. Each input can have a source IP allowlist of up to 20 IPv4 or IPv6 addresses or CIDR ranges, on Business, Pro and Enterprise plans. Requests from other addresses are rejected with 403 before anything is stored or forwarded, and forwarding headers like X-Forwarded-For are ignored.
How do you authenticate users and API access?
Passwords and token secrets are stored as one-way hashes. Access tokens can be limited by API role and bucket scope, and teams can sign in with SAML SSO. Every change is recorded in the audit log.
Do you have SOC 2?
Yes, SOC 2 Type II. Request the report and we'll send it, along with answers to your security questionnaire.
Can we self-host Webhook Relay?
Yes. A self-hosted version is available for teams that need every payload to stay on their own infrastructure.
Get Webhook Relay through your security review
Request the SOC 2 Type II report, send your questionnaire, or ask about self-hosting.
Free plan · No credit card required · 7-day money-back guarantee on paid plans