Compliance
What exists today, what a report would add, and when we will pursue one. Written so a security review can quote it instead of emailing us.
In short
- No SOC 2, HIPAA or PCI attestation today — this page is the honest substitute until there is one.
- What exists: EU residency, encryption of every secret at rest, RBAC with an audit log, verified inbound sources, and a tested SSRF guard.
- SOC 2 is committed when a customer contract requires it; the controls below are built to make that audit short.
What exists today, verifiable in the product
| Control | Status |
|---|---|
| Data residency | EU (Frankfurt) only. There is no other region to misconfigure |
| Secrets at rest | Endpoint secrets, destination credentials, mTLS keys — all encrypted with a server key; no plaintext column exists |
| Access control | Four roles, per-organisation, enforced server-side on every route |
| Audit log | Operator actions recorded with actor, action and parameters hash |
| Egress safety | Two independent layers against reaching private networks, covered by a dedicated test suite |
| Inbound verification | Fifteen providers verified against their own signatures before anything enters the pipeline |
| Delivery signing | Standard Webhooks over the exact bytes delivered, with overlapping secret rotation |
| Portal exposure | Consumer portal grants are scoped, expiring and signed — no accounts, no passwords to breach. Embedding is opt-in per link, so an ordinary link still refuses to render in a frame |
What a report would add, and our position
| Item | Position |
|---|---|
| SOC 2 Type II | Committed when a customer contract requires it. The controls above are maintained audit-shaped so the observation window is the long pole, not remediation |
| HIPAA / PCI-DSS | Not pursued: health and card data are not what this product should carry. The payload guard and archival exist for operational data |
| DPA | Available on request for paid plans |
| Subprocessors | An EU cloud infrastructure provider (Frankfurt), an object-storage provider for archived payloads, an email delivery provider for operational mail, and a managed Postgres provider. Named in the DPA |
Why publish this instead of waiting for the badge. A report attests yesterday's controls; the table above is checkable today. If a comparison page led you here expecting a certificate we do not have — that comparison page told you the truth, which is also how the rest of it was written.
Start delivering webhooks today
Point your webhooks at HookGet and watch the first delivery arrive, signed, in under a minute.
Create a free account Try the free webhook tester
10,000 deliveries a month free, no credit card. The free tier blocks rather than bills, so trying it cannot produce an invoice.