Security & Privacy

CatchHook is designed to handle sensitive webhook data responsibly. This page covers the security measures in place to protect your data.

Encryption at rest (account plans)

Pro, Team, and Business endpoints can enable encryption for the request body, headers, and source IP at rest. Temporary endpoints do not offer configurable encryption. When encryption is enabled:

• Data is encrypted before being written to the database.
• It's decrypted on the fly when you view it in the UI or access it via the API.
• Encryption keys are managed by the server and are not exposed in endpoint settings or API responses.

Enable encryption in the endpoint's Settings tab.

Sensitive header masking

Certain headers are automatically masked in the UI to prevent accidental exposure:

• Authorization
• X-Api-Key
• X-Api-Secret
• Other common secret headers

The full values are still stored (encrypted if endpoint encryption is on) and available when replaying or forwarding requests.

Inbound signature verification (webhook endpoints)

Webhook endpoints can be configured with provider signing secrets (GitHub, Stripe, Shopify, Slack, Twilio). CatchHook verifies signatures on ingest and stores per-request status:

• verified
• failed
• missing_signature
• not_configured

Verification is passive in v1: requests are still captured even when verification fails, so you can inspect and debug delivery issues safely.

Email authentication (email endpoints)

For email endpoints, CatchHook relies on AWS SES for transport-level email authentication. Each inbound email includes verification results for:

• SPF — verifies the sending server is authorized for the sender's domain
• DKIM — verifies the email content wasn't tampered with in transit
• DMARC — verifies domain policy alignment for SPF/DKIM
• Spam verdict — AWS SES spam scoring
• Virus verdict — AWS SES virus scanning

These results are displayed on each email event's detail page and included in the normalized JSON payload when forwarding or replaying.

SNS signature verification

Inbound email delivery from AWS SES arrives via SNS (Simple Notification Service) HTTPS notifications. CatchHook verifies the cryptographic signature on every SNS message — including subscription confirmations and notifications — to ensure messages genuinely originate from AWS and haven't been tampered with. Invalid signatures are rejected.

Email HTML sanitization

When displaying HTML email bodies, CatchHook renders them in a sandboxed iframe with:

• A restrictive Content Security Policy (default-src 'none')
• src and href attributes stripped from HTML to prevent external resource loads
• referrerpolicy="no-referrer" and sandbox="" attributes to prevent IP leakage
• SES transport headers (x-ses-*, return-path, received) filtered from display

Email header filtering

Email event headers are filtered before display and forwarding:

• SES transport headers are excluded (configurable via email_ingress.header_exclude_patterns)
• Sensitive header values are masked using the same DisplayRedactor as webhook events

SSRF protection

Hosted replay, test requests, Action Forward steps, and webhook notification channels use publicly reachable HTTP(S) destinations. The following address ranges aren't eligible for hosted outbound delivery:

• Private IP addresses (10.x.x.x, 172.16–31.x.x, 192.168.x.x)
• Loopback addresses (127.0.0.1, ::1)
• Link-local addresses

For localhost development, use the CatchHook CLI tunnel. These destination safeguards prevent server-side request forgery (SSRF) attacks.

Payload size limits

Incoming webhook payloads are limited to 10 MB. Requests exceeding this limit are rejected.

AI processing and redaction

CatchHook does not automatically send every captured payload to an AI model. AI summaries and handler generation run only when an account user requests those features, and supported requests may be handled by local deterministic logic without an external model call.

Before an external model call, CatchHook bounds the payload and redacts common secret-bearing keys, bearer credentials, Stripe keys, email addresses, phone numbers, and IP addresses. Automated redaction is a safeguard, not a substitute for reviewing payloads before requesting AI analysis. MCP access is separate: your authorized editor receives the request data returned by the tools you invoke, subject to that editor's own data-handling settings.

Rate limits

Rate limits protect against abuse and ensure fair usage:

When rate-limited, you'll receive an HTTP 429 Too Many Requests response with a retry_after value.

Authentication

User authentication

• Email and password with secure hashing (minimum 8 characters).
• OAuth via Google and GitHub.
• Session-based authentication with secure cookies.
• Account lockout — 10 failed login attempts locks the account for 15 minutes.
• Session timeout — inactive sessions expire after 2 hours.

API authentication

• Bearer token authentication for all API endpoints.
• Tokens are scoped (read, tunnel) to limit access.
• CLI tokens expire after 30 days.
• Tokens can be revoked instantly from Account Settings.

Data retention

Webhook requests are automatically purged after your plan's retention period:

Temporary endpoints and their captured events expire after 48 hours. Account users can delete individual events or all events for an endpoint before automatic retention runs. Deleted data cannot be recovered.

See the Privacy Policy for the broader data-processing and account-deletion policy.

Multi-tenancy

CatchHook uses strict tenant isolation. Each account's data is scoped so that users can only access endpoints, requests, and settings belonging to their own account. Team-scoped endpoints add an additional layer of access control within an account.