Security
Everything on this page describes what is implemented today — no roadmap items, no aspirations. For data-handling details, see the privacy policy.
Data in transit and at rest
TLS everywhere
All API, console, and webhook traffic is served over HTTPS. Webhook endpoints you register must be HTTPS.
Encryption at rest
Data is stored in managed Postgres (Neon) with encryption at rest; backups are encrypted by the provider.
API keys and authentication
Hashed keys, timing-safe verification
API keys are stored as SHA-256 digests, never plaintext, and verified with constant-time comparison. Keys are shown once at creation and support rotation with grace periods.
Two-factor authentication
Console accounts support TOTP two-factor authentication; administrative access requires it in production.
Organization-scoped roles
Keys, webhooks, and billing actions are scoped to your organization with owner/admin/member roles enforced server-side.
Webhooks
Signed deliveries
Every webhook is HMAC-SHA256 signed (t=<timestamp>,v1=<signature>) so your receiver can verify origin and reject replays. Secrets can be rotated from the console.
Endpoint protections
Registered endpoints are validated against private and unroutable address space to prevent server-side request forgery, re-checked at delivery time.
Request logs and retention
Credential redaction
Request and response bodies stored for debugging have sensitive credentials (authorization headers, key material) redacted before storage.
90-day retention with automatic cleanup
Stored request and response bodies are deleted automatically after 90 days. Full retention schedule is published in the privacy policy.
Access control
Request bodies are visible only to authorized roles within your organization; member-level access receives redacted views.
Platform
Rate limiting
Layered rate limits per key and per organization protect the platform; authentication endpoints are separately limited and fail closed.
Monitoring
Server-side error monitoring (Sentry) with PII sending disabled; operational logs are structured and access-controlled.
Subprocessors
| EasyPost | Carrier tracking data |
| Stripe | Payments and invoicing |
| Neon | Postgres database |
| Vercel | Hosting and edge network |
| Upstash | Rate limiting |
| Resend | Transactional email |
| Sentry | Error monitoring |
Reporting a vulnerability
We welcome responsible disclosure. Report suspected vulnerabilities to with reproduction steps. We acknowledge reports promptly, keep you informed while we investigate, and ask that you give us reasonable time to remediate before public disclosure.