Skip to content
Start free

Security

What is true today.

  • Production data is stored in Postgres when DATABASE_URL is set. On Railway, Postgres disks are encrypted at rest by the platform. DropAgent does not add a second layer of column encryption.
  • Workspace API keys are stored as SHA-256 hashes. The full key is shown once, when it is created.
  • OAuth access and refresh tokens are stored as hashes. Tokens are limited to the scopes approved on the consent screen. Bearer API keys are not scoped; revoke a key to cut it off.
  • Outbound webhooks are signed with HMAC-SHA256. The header is X-DropAgent-Signature: t=<unix>,v1=<hex> over timestamp + "." + the raw body.
  • An audit log records workspace actions such as key rotation and signup completion, with an actor and a timestamp.
  • DropAgent does not have a SOC 2 report.

Service health is published at /status.