How we handle your clients' API keys
- Keys are encrypted with AES-GCM before they are stored. The encryption key is a server secret and is never kept in the database.
- The service only reads. It calls three n8n endpoints: the workflow list, the run list and a single run. It never creates, edits, runs or deletes anything.
- Keys never appear in logs, in error messages or in the text sent to the AI model that writes client notes. The model sees only the alert type, the workflow and step names, the time and the first 500 characters of the error message.
- Deleting a client server deletes its key.
- Card payments go through the Dodo Payments checkout page. Card details never reach this service.
Use a separate n8n user
On n8n plans below Enterprise, every API key has full access to everything its user can see. Create the key from a separate n8n member user who can only see the projects you want watched.