PT EN
← Back
Security & Privacy

Your data, under control

httpdrop was built with data isolation and privacy from day one. Here is what we do to keep your endpoints and requests secure.

Authentication
  • Login exclusively via OAuth (GitHub · Google) — no passwords stored
  • Sessions with HttpOnly + SameSite=Lax cookie, configurable expiry
  • API token for programmatic access, revocable at any time
  • Remote logout of all active sessions from the dashboard
Data Isolation
  • Each endpoint belongs to a single user or workspace — no data is shared across accounts
  • Third-party requests are never visible to other users
  • Request data expires automatically based on plan limits
  • Team+ workspaces have full isolation within the organization account
Data Masking (Redaction)
  • Team+ plans: masking policies automatically redact sensitive fields
  • Configurable fields: CPF, CNPJ, e-mail, card numbers, passwords, tokens and more
  • Redaction happens before dashboard display — the raw value is never exposed
  • Workspace-level rules applied to all team members
Access Control
  • IP-based rate limiting to protect against abuse
  • Paid plans and admins are exempt from global throttling
  • Endpoints can be set as private (token-required) or public
  • API portal with per-endpoint visibility control
On-Premise (Enterprise)
  • Deploy via Docker inside your organization's own infrastructure
  • No data ever leaves your network — full storage control
  • Environment variables for auth, limits and database configuration
  • Ideal for compliance-heavy or air-gapped environments
LGPD & Privacy
  • We collect only: OAuth data (name, e-mail, avatar) and usage logs
  • We do not share personal data with third parties or marketing partners
  • Right to erasure: delete your account and all data from the dashboard
  • HTTP requests received by your endpoints belong to you
Transparency: httpdrop does not yet hold formal security certifications (SOC 2, ISO 27001). What you find on this page are the technical practices and features we have implemented — no marketing fluff. If you have a specific compliance requirement, reach out.

Need full control?

The Enterprise plan includes on-premise deployment in your own infrastructure, dedicated support and compliance customizations. Data never leaves your organization.

See Enterprise plans