Review how Axel authenticates senders, limits data access, and retains payloads. The implementation and security policy are public. Vulnerability reports stay private.
These controls cover source authentication, storage, route execution, and administrative access. Self-host operators also manage the security of their host and provider accounts.
Axel stores custom-source ingest tokens as SHA-256 hashes and validates them with constant-time comparison. Custom sources use the x-axel-token header by default. Senders without custom headers can use a separately generated URL credential, enabled per source and rotated independently. Treat authenticated URLs as secrets; sender and proxy logs may record them. Named-provider sources use the provider's signature or webhook Basic Auth instead of an Axel token.
SHA-256The edge requires TLS 1.2 or newer. Cloudflare R2 encrypts raw payload objects at rest. Self-host operators remain responsible for encryption of their Docker host, backups, and any optional data stores.
TLS 1.2+Route filters and transforms use an eval-free declarative language. Routes cannot execute customer JavaScript, read files, or start processes.
no evalPostgres rows, ClickHouse records, object keys, and queue messages carry workspace scope. Dashboard and service queries require the active workspace identifier.
workspace scopedDefaults are 30 days for raw payloads and event traces, 90 days for dead letters, 30 days for replay-request records, and 365 days for audit logs. Configurable ranges are documented below and applied by scheduled cleanup jobs. The small self-host profile uses fixed 30-day raw retention.
30 daysAxel records supported administrative changes such as workspace creation, member invitations and role changes, source lifecycle changes, destination changes, and replay requests. Each record includes an actor and timestamp.
actor + timeUse the security policy to report a vulnerability. The review record documents past findings and fixes; the self-hosting guide covers deployment requirements.
Axel uses TLS 1.2 or newer at the edge, encrypts raw R2 objects at rest, stores source ingest tokens as SHA-256 hashes, checks data access against workspace membership, and runs route filters and transforms without executing customer JavaScript.
Email security@axelapp.ai with the requirements for your review. Ask for the documentation you need before relying on a certification or control. The product controls described here are not a certification report.
By default, raw webhook payloads and event traces are retained for 30 days, dead letters for 90 days, replay-request records for 30 days, and audit logs for 365 days. Configurable ranges are 0–30 days for raw payloads, 1–365 for dead letters, 1–90 for replay requests, and 30–3,650 for audit logs.
Postgres rows, object-storage keys, queue messages, and analytics records carry a workspace identifier. Dashboard and service queries require workspace scope, and authorization checks bind requests to the active workspace.
Treat a missing 202 response as an unaccepted event and retry according to the sender's webhook policy. Axel only returns 202 after it has accepted and stored the original payload.
Report vulnerabilities privately through GitHub or email security@axelapp.ai. Include the affected component, reproduction steps, and potential impact. Please keep credentials and customer payloads out of public issues.