How does BeforeQuery secure integrations?

Integration credentials — API keys, OAuth tokens, webhook secrets — are encrypted at rest with AES-256-GCM, per-workspace envelope. When admins read the connection back through the dashboard or API, secret fields render as __redacted__; the plaintext never leaves the request path that stored it.

Every outbound HTTP call is SSRF-checked before it leaves the process: the URL cannot resolve to a private IP range, cannot embed credentials, cannot target cloud metadata endpoints. Every redirect hop is re-checked. Applies to first-party providers, UIA-mediated providers, and any HTTP action you configure yourself.

Writes that support idempotency (Stripe, Resend, Sendgrid) get the invocation ID as the idempotency key, so a retry on a network blip never double-charges a customer.

For regulated buyers we support per-workspace IP allowlists on outbound calls and, on Enterprise, private-provider hosting — you run the connector container in your own VPC, we call your endpoint over a mutual-TLS tunnel, and no credentials ever cross our boundary.

Every integration credential change writes to the audit log (rotated, added, removed, tested). If a credential is rotated in the upstream system, the next call fails cleanly and we surface it on the health dashboard rather than retrying silently.