Review how Axel authenticates senders, limits data access, and retains payloads. Report vulnerabilities privately by email.
These controls cover source authentication, storage, route execution, and administrative access.
Axel stores custom-source ingest tokens as SHA-256 hashes and validates them with constant-time comparison. Custom sources use the x-axel-token header by default. Senders without custom headers can use a separately generated URL credential, enabled per source and rotated independently. Treat authenticated URLs as secrets; sender and proxy logs may record them. Named-provider sources use the provider's signature or webhook Basic Auth instead of an Axel token.
SHA-256The edge requires TLS 1.2 or newer. Cloudflare R2 encrypts raw payload objects at rest.
TLS 1.2+Route filters and transforms use an eval-free declarative language. Routes cannot execute customer JavaScript, read files, or start processes.
no evalPostgres rows, ClickHouse records, object keys, and queue messages carry workspace scope. Dashboard and service queries require the active workspace identifier.
workspace scopedDefaults are 30 days for raw payloads and event traces, 90 days for dead letters, 30 days for replay-request records, and 365 days for audit logs. Configurable ranges are documented below and applied by scheduled cleanup jobs.
30 daysAxel records supported administrative changes such as workspace creation, member invitations and role changes, source lifecycle changes, destination changes, and replay requests. Each record includes an actor and timestamp.
actor + timeAxel uses TLS 1.2 or newer at the edge, encrypts raw R2 objects at rest, stores source ingest tokens as SHA-256 hashes, checks data access against workspace membership, and runs route filters and transforms without executing customer JavaScript.
Email security@axelapp.ai with the requirements for your review. Ask for the documentation you need before relying on a certification or control. The product controls described here are not a certification report.
By default, raw webhook payloads and event traces are retained for 30 days, dead letters for 90 days, replay-request records for 30 days, and audit logs for 365 days. Configurable ranges are 0–30 days for raw payloads, 1–365 for dead letters, 1–90 for replay requests, and 30–3,650 for audit logs.
Postgres rows, object-storage keys, queue messages, and analytics records carry a workspace identifier. Dashboard and service queries require workspace scope, and authorization checks bind requests to the active workspace.
A share link shows a fixed copy of one report's numbers for seven days. It does not grant access to queries, other reports, or raw events. Axel stores only a SHA-256 hash of the link's token, and owners and administrators can revoke a link at any time. Reports never copy subscriber or customer fields. A subscriber or customer ID becomes a one-way key used only to count unique people.
Treat a missing 202 response as an unaccepted event and retry according to the sender's webhook policy. Axel only returns 202 after it has accepted and stored the original payload.
Email security@axelapp.ai to report a vulnerability. Include the affected component, reproduction steps, and potential impact. Leave credentials and customer payloads out of your report.