Security ยท updated 8 November 2026
ActionBridge security and data handling
ActionBridge holds third-party API credentials, so it stores as little as possible: the converted tool list, credentials encrypted with AES-256-GCM, hashes of your keys, and 30 days of request metadata. Tool arguments, request bodies and API responses pass through and are never stored or logged.
What is stored
| Data | Form | Kept for |
|---|---|---|
| Converted tools, API base URL, auth type, connector name and instructions | Plain JSON | Until you delete the bridge |
| API key, bearer token, password, OAuth client secret | Encrypted (AES-256-GCM, per-bridge data key wrapped by a master key held as a Worker secret) | Until you delete the bridge or replace the credential |
| Access key, management key, licence key | SHA-256 hash only; the key is shown to you once | Until rotated or deleted |
| OAuth tokens and per-user API tokens | Hashed tokens; grant data encrypted with a key only the token holder can unwrap | Until expiry or revocation (refresh tokens up to 90 days) |
| Request metadata: time, bridge, tool name, outcome, status code, duration | Plain | 30 days |
| Monthly call and error counts | Plain | For billing and support |
What is never stored
Tool arguments, request bodies, query strings, API responses and HTTP headers. Logs contain no URLs with query strings and no credentials; the end-to-end tests check this against every secret used.
Outbound calls (SSRF protection)
- Only
https://on ports 443 or 8443, to the API base URL you configured; path parameters are encoded and cannot leave it. - Private, loopback, link-local, carrier-grade NAT and cloud-metadata addresses are refused, in IPv4 and IPv6 forms, including names that resolve to them (checked over DNS-over-HTTPS) and redirects that lead to them.
- Credentials are dropped if a redirect leaves your API's origin. The Worker also runs with Cloudflare's strictly-public fetch setting.
Access control
- Private bridges need the access key, as a Bearer header or entered once on the OAuth consent page. OAuth tokens are bound to one bridge and to its current access key, so rotating the key disconnects every client.
- Per-user OAuth bridges accept only tokens from a completed sign-in to your API.
- Rate limits per client address and per bridge; request bodies over 256 KB are refused.
Deleting your data
Deleting a bridge in the app wipes its stored credentials, key hashes and tool configuration at once; request metadata ages out within 30 days. Email us to delete licence records.
Processors
Cloudflare (hosting, D1 database, KV storage). Payments, once online checkout opens, through Freemius as merchant of record.
Reporting a security issue
Email [email protected] with "ActionBridge security" in the subject. We reply within 2 business days.
Last updated 8 November 2026. Questions or corrections: [email protected].