Your Airtable data, handled carefully

Simplified Webhooks runs on managed cloud platforms. Every component that receives, processes, or stores your webhook data is hosted in the EU.

• API and background jobs on Google Cloud Run, region europe-west1 (Belgium)
• Scheduling and delivery queues on Google Cloud Scheduler and Cloud Tasks, same region
• Managed PostgreSQL and authentication on Supabase, EU region — Frankfurt (eu-central-1)
• Marketing site and dashboard on Vercel, with server-side rendering pinned to the Frankfurt region (fra1)
• Secrets held in Google Secret Manager, never in source control or container images

Data is encrypted in transit everywhere, and your Airtable credentials get an additional layer of application-level encryption on top of disk encryption.

• TLS for all traffic: Airtable to us, browser to us, and us to your endpoint
• Airtable personal access tokens and OAuth tokens encrypted with AES-256-GCM before they are written to the database
• Encryption keys kept in Google Secret Manager, separate from the database
• API keys are never stored in readable form — only a SHA-256 hash is kept, so a database dump cannot be replayed against the API
• Storage-level encryption at rest provided by our database and hosting platforms

Every request is authenticated, and every row in the database is scoped to its owner.

• API access via a Supabase-issued JWT or a personal API key; both resolve to a single user account
• Row-level security in PostgreSQL, so a session can only read rows belonging to that user
• Incoming Airtable pings are verified against Airtable’s HMAC signature before they are processed
• Administrative access is restricted to an explicit allowlist, protected by two-factor authentication, and every administrative action is written to an audit log
• Least-privilege service accounts for scheduled jobs, authenticated with signed OIDC tokens

You stay in control of what flows through the service. This is the complete list of what lands in our database.

• Account data: email address, name, and plan
• Connection credentials: your encrypted Airtable token, plus the base and table IDs you connect
• Event data: the Airtable payload of each change event and the transformed payload we forward, so you can inspect deliveries in the dashboard — the content is whatever your Airtable records contain. It is deleted automatically 30 days after the event
• Delivery metadata: timestamps, HTTP status codes, error messages, and retry state — kept without any record content once the payload has been deleted
• Record-count snapshots: per-table row counts for the bases you choose to track, no record content

A missed webhook is a data-integrity problem, so delivery is built to survive failures on either side.

• Failed deliveries are retried automatically with exponential backoff
• Deliveries run through a managed queue, so a slow endpoint of yours never blocks other events
• Airtable webhooks are refreshed on a schedule so they cannot silently expire
• Continuous monitoring with automated alerting on delivery failures
• Managed database hosting with provider-side automated backups

Simplified Webhooks is operated by Synergetic GmbH, a company registered in Germany, and is therefore subject to the GDPR.

• When we forward your Airtable data, you are the controller and we act as your processor under Art. 28 GDPR
• A Data Processing Agreement, including our technical and organisational measures and this sub-processor list, is available to every customer on request — on paid and free plans alike
• Payload content is deleted automatically 30 days after the event; only content-free delivery metadata is retained beyond that
• All processing of webhook data happens in the EU, on the infrastructure listed above
• You can delete a webhook or your entire account at any time, which removes the associated event history
• For a copy of your data, a deletion request, or questions from your data protection officer, contact us and we will respond