Beveiliging & Data Privacy

Your Webhook Data, Encrypted & Ephemeral

Real-time webhook debugging voor Nederlandse developers. Every payload is encrypted in transit with TLS 1.3 and purged from our servers within 24 hours — no exceptions.

WebhookWatch security dashboard showing TLS 1.3 encrypted payloads, HMAC verification status, and a live 24-hour retention countdown timer

Security Features

Built for Fintech-Grade Data Protection

WebhookWatch processes over 2.4 million webhook events monthly for Dutch SaaS companies, payment processors, and e-commerce platforms. Every single byte is handled with a zero-retention architecture designed from the ground up for sensitive financial data.

🔐

TLS 1.3 End-to-End Encryption

All webhook payloads transit over TLS 1.3 with perfect forward secrecy. No plaintext data ever touches our infrastructure — even during temporary buffering. Fully compatible with Mollie, Adyen, and iDEAL payment webhooks.

⏱️

Automatic 24-Hour Purge

Every received payload is permanently deleted from our primary storage after exactly 24 hours. The purge job runs at 00:00 CET daily. No manual intervention required. No data recovery possible after deletion.

🛡️

HMAC Signature Verification

Built-in verification for Mollie (Mollie-Account-Id header), Adyen (x-adyen-signature), and Stripe (Stripe-Signature) webhooks. Tampered or unsigned payloads are rejected before they reach your debug panel.

📦

AES-256 At-Rest Encryption

The 24-hour window uses AES-256-GCM encryption for temporary disk storage. Encryption keys are rotated every 7 days and stored in a separate HSM module, never on the same server as payload data.

Compliance & Transparency

GDPR-Compliant by Design

WebhookWatch is registered with the Autoriteit Persoonsgegevens as a data processor. We maintain a full Data Processing Agreement (DPA) for every enterprise customer and comply with AVG/GDPR requirements for webhook data handling.

24h

Maximum Data Retention

TLS 1.3

Transport Encryption

AES-256

At-Rest Encryption

0

Data Breaches Since 2021

100%

GDPR Compliant

Our infrastructure is hosted exclusively in Frankfurt (DE) and Amsterdam (NL) data centers operated by Hetzner and OVHcloud. No webhook data ever leaves the European Union. We publish quarterly transparency reports and maintain full audit logs available upon request. If you need to exercise your right to erasure before the 24-hour window expires, you can trigger immediate deletion from your account dashboard or by emailing privacy@webhookwatch.nl.

📋

Data Processing Agreement

Standard DPA available under EU Standard Contractual Clauses. Covers webhook payload processing, temporary storage, and automated deletion. Request via email or your account dashboard.

🏢

EU-Based Infrastructure

All servers are hosted in Frankfurt and Amsterdam. No data ever leaves the European Union. Full audit logs and penetration test summaries available upon request.

Sample Retention Metadata

{
  "webhook_id": "wh_9f8e7d6c5b4a",
  "received_at": "2025-01-15T14:32:07Z",
  "encrypted": true,
  "encryption_method": "AES-256-GCM",
  "retention_until": "2025-01-16T14:32:07Z",
  "purge_scheduled": true,
  "data_subject_rights": {
    "access": true,
    "rectification": true,
    "erasure": true,
    "portability": true
  }
}