InstaWebhook

Security

Security controls before credentials, payloads, or production traffic.

InstaWebhook is designed around least privilege, encrypted storage, auditability, and clear deletion controls. BYO database setup is optional and guided.

Hosted storage

  • Payload bodies, headers, and query params are encrypted at the application layer.
  • Operational metadata remains available after payload deletion.
  • Rate and payload limits protect the intake path.

BYO database

  • Payload storage can live in a customer-controlled PostgreSQL schema.
  • The setup flow explains roles and grants before credentials are entered.
  • Credential rotation verifies the new connection before saving it.

Credential handling

Connection strings and signing secrets are encrypted and never displayed in full after saving.

Least privilege

BYO setup uses dedicated PostgreSQL roles, a dedicated schema, explicit grants, and no superuser permissions.

Audit logs

Sensitive actions record actor, target, timestamp, IP address, user agent, and redacted metadata.

Deletion and export

Customers can export operational records, delete payload bodies, rotate tokens, disconnect BYO databases, and request deletion.