Security
What the code does today, stated plainly. Railhook is open source, so you can check every claim on this page against the repository.
Railhook Cloud is the hosted service at railhook.io. A copy you run yourself sends us nothing.
The servers run at Hetzner in Helsinki, Finland.
Traffic reaches the servers through Cloudflare, which provides the CDN, DNS and the Turnstile check at sign-up.
Transactional email, such as address verification and password resets, is sent through Resend.
Self-hosted Railhook runs entirely on your infrastructure. Your events, secrets and accounts never reach us.
Nothing that grants access is kept in a form someone could use after reading the database.
Endpoint and source signing secrets and mTLS client keys are encrypted with AES-256-GCM. Encryption keys are versioned, and an operator can re-encrypt every secret under a new one.
A project API key is shown once, when it is created. Railhook keeps only its SHA-256 hash. A key can be rotated with a grace period, or revoked.
Passwords are stored as bcrypt hashes. An account that signs in with Google has no password at all.
Access tokens last 15 minutes. The refresh token sits in an HttpOnly cookie and is replaced on every use; if a used one is presented again, every session of that user ends. You can see your sessions and end any of them.
Every database query is scoped to the caller's organization by the data layer itself, lookups by id included, so no feature depends on remembering the check. Another organization's resource answers 404.
People are Owners, Developers or Viewers. An API key belongs to one project and can be read-only.
Sign-ins, member and role changes, rotated secrets, replays and purges are recorded in the organization's audit log.
Sign-in and registration are rate-limited, repeated failed sign-ins lock the account for a growing interval, and registration on Railhook Cloud passes a Cloudflare Turnstile check.
HMAC-SHA256 over the payload, in Railhook's own header and in the Standard Webhooks format. After a secret is rotated, deliveries are signed with both secrets for 24 hours, so receivers switch without downtime.
Stripe, GitHub, GitLab, Shopify, Slack and Twilio requests are checked with each provider's own scheme before anything is stored. A request that fails is answered 401 and not stored, and a replayed signature is refused.
Endpoint URLs are checked when they are saved and again before every attempt. Loopback, link-local and private addresses are refused, so a webhook cannot be aimed at internal services.
An endpoint can require Railhook to present a client certificate (mTLS), and a deployment can require every endpoint to prove it owns its URL before it receives anything.
Masking rules hide emails, phone numbers, card numbers and fields you name, in the dashboard and in shared debug links.
On the Railhook Cloud free plan, webhook events are kept for 7 days and then deleted.
An owner can export an organization's data and delete the organization. Anyone can delete their own account in the product.
We do not sell data and do not use advertising trackers.
Please do not open a public issue. Report it privately through GitHub, as the security policy describes, and it will be fixed on the latest release line.