Security and trust
Connect monitoring without unnecessarily expanding risk.
API keys, OAuth tokens, organisation boundaries, auditability and shared responsibility: the public scope of Datvero controls and their limitations.
- Author
- Datvero
- Updated
- Method
- Product + primary documentation
Direct answer
Direct answer
Datvero server code validates n8n, Make and Zapier connections, encrypts platform secrets before storage and excludes them from normal read responses. These measures reduce exposure; they are not a certification and do not replace least privilege, rotation or security on connected platforms.
Secrets have a lifecycle
Create API keys and OAuth tokens for a defined purpose, limit their permissions, transmit them over protected connections, store them under control and revoke them when no longer required. Encryption at rest is one layer, not a reason to grant broad access.
- Use a dedicated credential instead of a general administrator key.
- Record owner, scope, creation date and revocation process.
- Rotate immediately after exposure or ownership loss.
Separate organisations, users and resources
Authenticated routes must filter connected resources and incidents by organisation. Roles and two-factor authentication add controls but do not compensate for a compromised session or excessive permissions.
- Check organisation ownership on every read and mutation.
- Limit administrators and remove obsolete accounts promptly.
- Attribute connection changes and sensitive incident actions.
Collect only the data needed to observe
Monitoring should retain the identifiers, timestamps, states and error context needed for diagnosis without copying arbitrary payloads. Customers remain responsible for the data they send in heartbeat metadata and for platform-specific retention.
- Avoid secrets and unnecessary personal data in logs or heartbeat metadata.
- Define retention according to operational and legal needs.
- Treat exports and support access as controlled operations.
Security remains a shared responsibility
Datvero can protect its storage, routes and organisational boundaries. Customers configure source-platform permissions, workflow logic, destination access and response procedures. Third-party availability and vulnerabilities remain outside a universal guarantee.
- Keep connected platforms and integrations up to date.
- Test revocation, recovery and incident contact paths.
- Do not interpret public documentation as a security certification.
Verifiability
Primary sources and documentation
External sources explain platform capabilities or general practices. They do not certify or endorse Datvero.
- Secrets Management Cheat Sheet
OWASP Cheat Sheet Series — Digital identity and authentication guidance.
- Cybersecurity Framework 2.0
National Institute of Standards and Technology — Application security verification controls.
- SP 800-61 Rev. 3 — Incident Response Recommendations
National Institute of Standards and Technology — General guidance for secure handling of secrets and access.
FAQ
Frequently asked questions
Does Datvero store platform credentials in plain text?
The documented server implementation encrypts supported API keys and OAuth tokens before persistence and omits them from normal read responses.
Does encryption make a broad API key safe?
No. Least privilege, ownership, rotation and revocation remain necessary.
Is Datvero security certified?
This page does not claim a certification. It describes public implementation boundaries and shared responsibilities.