Best-in-class compliance features
Never at an additional cost
Compliance and auditability are at the root and core of our mission. We consider it a product standard, not an upsell.
API Event Log
Machine access is governed and logged like everything else. Key lifecycle and security events stream into a live, environment-scoped feed that feeds Compliance export. Worked example with synthetic data, matching the product columns.
| Time | Event | Resource | Source | Mode |
|---|---|---|---|---|
| 14:02:11 | api_key.created | ss_live_a3f9… | Aisha Reyes · 203.0.113.24 | LIVE |
| 14:06:48 | api_key.first_used | ss_live_a3f9… | service · 203.0.113.24 | LIVE |
| 02:14:55 | api_key.compromised | ss_live_a3f9… | system · anomaly engine | LIVE |
| 02:15:03 | api_key.revoked | ss_live_a3f9… | system · auto-revoke | LIVE |
| 09:48:20 | api_key.rotated | ss_live_b7c2… | Marcus Osei · 203.0.113.51 | LIVE |
| 11:30:12 | api_key.first_used | ss_test_4d10… | service · 198.51.100.7 | TEST |
Illustrative rows. Key prefixes, IPs, and actors are synthetic. The api_key.compromised row shows anomaly detection auto-revoking a key.
API key anomaly detection
Unusual usage on a key is flagged within about five minutes and can auto-revoke. A leaked or runaway key is caught fast, before it becomes a surprise on the bill.
HMAC-signed webhooks
Every webhook carries a signature computed from a per-endpoint signing secret. Verify it on receipt to prove the payload came from us and was not altered in transit.
Idempotency keys
Send an idempotency key with any write and a safe retry returns the original result instead of double-processing. Network blips never create duplicate work.