Security
OutcomeGuard reads your automation platform and stores as little as it can get away with. This page sets out exactly what that means, in concrete terms, with no claims we cannot support.
Access to your instance
- Access is read-only. OutcomeGuard calls the n8n public REST API to list workflows and executions and does nothing else with it.
- It never creates, edits, activates or deactivates a workflow, and never reads or changes credentials stored in n8n.
- It uses the API key you provide, and nothing beyond what that key can see. We ask for no platform-level or host-level access.
- Least privilege applies internally too: each component gets only the access its job requires.
Your API key
- API keys are encrypted at rest with AES-256-GCM.
- Encryption keys live only in the runtime environment. They are never in source code, never in git, never in logs.
- Key rotation is supported, including decrypting data written under the previous key during a rotation.
- The key used for a free scan is discarded when the scan finishes. It is only stored if you connect the instance to an account.
What we store, and what we never store
- We store execution summaries: status, start and stop timestamps, duration, item counts, the name of the last node executed, the workflow definition hash, and error messages with secrets redacted.
- We never store raw execution payloads. The records your workflows move — customer data, documents, message bodies, attachments — are not copied into OutcomeGuard.
- Error messages pass through redaction before storage, so tokens, keys and credentials in error text do not survive into our database or our alerts.
- Alerts contain the same summary-level evidence, not your business data.
In transit
- All traffic uses TLS, both between you and OutcomeGuard and between OutcomeGuard and your instance.
- Billing webhooks are verified by signature before they are processed.
- Scan targets on private networks are rejected rather than probed.
Retention and deletion
- Execution summaries are retained for 90 days.
- Free scan reports are deleted after 7 days.
- Disconnecting an integration removes its stored credential and its execution summaries.
- Deleting your account removes the workspace and the data belonging to it.
Isolation and accountability
- Tenant isolation is enforced by workspace scoping on every query, which is what keeps one client's data out of another client's view on the Agency plan.
- Administrative and security-relevant actions are written to an audit log.
- Rate limiting protects both our service and the instances we read.
Automatic actions
- Self-healing is deliberately narrow: retrying our own checks, re-sending a failed notification, re-running a verification.
- OutcomeGuard never rewrites a workflow, changes a credential, or alters billing or configuration on your behalf.
- If an instance cannot be reached, the status becomes UNKNOWN. We do not infer health from silence.
What we do not claim
We hold no security certifications. We are not SOC 2 or ISO 27001 certified, and we will not imply otherwise until that changes.
We publish no uptime percentage on these plans, and no customer counts or logos. When there is something audited to show, it will appear here with a date on it.
Reporting a vulnerability
If you find a security problem, write to the support address on the contact page with enough detail to reproduce it. We will confirm receipt, keep you updated while we fix it, and credit you if you would like that.