Beveiliging & Data Privacy
Your Webhook Data, Encrypted & Ephemeral
Real-time webhook debugging voor Nederlandse developers. Every payload is encrypted in transit with TLS 1.3 and purged from our servers within 24 hours — no exceptions.
Security Features
Built for Fintech-Grade Data Protection
WebhookWatch processes over 2.4 million webhook events monthly for Dutch SaaS companies, payment processors, and e-commerce platforms. Every single byte is handled with a zero-retention architecture designed from the ground up for sensitive financial data.
TLS 1.3 End-to-End Encryption
All webhook payloads transit over TLS 1.3 with perfect forward secrecy. No plaintext data ever touches our infrastructure — even during temporary buffering. Fully compatible with Mollie, Adyen, and iDEAL payment webhooks.
Automatic 24-Hour Purge
Every received payload is permanently deleted from our primary storage after exactly 24 hours. The purge job runs at 00:00 CET daily. No manual intervention required. No data recovery possible after deletion.
HMAC Signature Verification
Built-in verification for Mollie (Mollie-Account-Id header), Adyen (x-adyen-signature), and Stripe (Stripe-Signature) webhooks. Tampered or unsigned payloads are rejected before they reach your debug panel.
AES-256 At-Rest Encryption
The 24-hour window uses AES-256-GCM encryption for temporary disk storage. Encryption keys are rotated every 7 days and stored in a separate HSM module, never on the same server as payload data.
Compliance & Transparency
GDPR-Compliant by Design
WebhookWatch is registered with the Autoriteit Persoonsgegevens as a data processor. We maintain a full Data Processing Agreement (DPA) for every enterprise customer and comply with AVG/GDPR requirements for webhook data handling.
Our infrastructure is hosted exclusively in Frankfurt (DE) and Amsterdam (NL) data centers operated by Hetzner and OVHcloud. No webhook data ever leaves the European Union. We publish quarterly transparency reports and maintain full audit logs available upon request. If you need to exercise your right to erasure before the 24-hour window expires, you can trigger immediate deletion from your account dashboard or by emailing privacy@webhookwatch.nl.
Data Processing Agreement
Standard DPA available under EU Standard Contractual Clauses. Covers webhook payload processing, temporary storage, and automated deletion. Request via email or your account dashboard.
EU-Based Infrastructure
All servers are hosted in Frankfurt and Amsterdam. No data ever leaves the European Union. Full audit logs and penetration test summaries available upon request.
Sample Retention Metadata
{
"webhook_id": "wh_9f8e7d6c5b4a",
"received_at": "2025-01-15T14:32:07Z",
"encrypted": true,
"encryption_method": "AES-256-GCM",
"retention_until": "2025-01-16T14:32:07Z",
"purge_scheduled": true,
"data_subject_rights": {
"access": true,
"rectification": true,
"erasure": true,
"portability": true
}
}