How we handle your clients' API keys
- Keys are encrypted with AES-GCM before they are stored. The encryption key is a server secret and is never kept in the database.
- The service only reads. It sends GET requests to three n8n endpoints: the active workflow list /api/v1/workflows, the run list /api/v1/executions and a single run with its data /api/v1/executions/{id}. It never creates, edits, runs or deletes anything.
- n8n API keys can usually do more than read, and we can't narrow a key ourselves. That's why we ask you to use a separate n8n user, below.
- Keys never appear in logs, in error messages or in the text sent to the AI model that writes client notes. The model sees only the alert type, the workflow and step names, the time and the first 500 characters of the error message.
- Deleting a client server deletes its key.
- Alert emails go through Resend and carry the same text as your Telegram alerts: client and workflow names, the error and the note. Turn email alerts off any time on the Alert channels page, or with the link in every email.
- Card payments go through the Dodo Payments checkout page. Card details never reach this service.
Use a separate n8n user
On most n8n plans, every API key has full access to everything its user can see. Create the key from a separate n8n member user who can only see the projects you want watched.