Security
How credentials are stored, what the probe can and cannot do, and what we retain.
How database credentials are stored
Connection strings are envelope-encrypted with AES-256-GCM under an optional KMS-held key, bound to your organisation and project by additional authenticated data.
Reviewed 2026-08-23Why we say zero data access, and how it is built
Six fixed introspection statements over pg_catalog and bucket metadata, zero bind parameters, exported as INTROSPECTION_QUERIES so anyone can audit what runs.
Reviewed 2026-08-23Probe safety: methods and refused addresses
The external probe issues GET, HEAD and OPTIONS only and refuses loopback, RFC1918, link-local, CGNAT and cloud-metadata addresses, re-checked on every redirect hop.
Reviewed 2026-08-23What we keep, and what we never retain
Leaked rows are reported as column names and counts, keys as fingerprints, webhook URLs masked, errors as fixed phrases. Deliberately thin retention, itemised.
Reviewed 2026-08-23