GDPR compiant webhook as a service
GDPR compiant webhook as a service
Ploq is a webhook delivery service hosted within the European Union. Its primary function is to receive outbound webhook payloads from an application and reliably deliver them to one or more configured endpoints. The service handles retries, signing, and monitoring, allowing developers to offload the infrastructure required for reliable webhook distribution. The service includes automatic retries following an exponential schedule: 30 seconds, 5 minutes, 30 minutes, 2 hours, and 12 hours, with each attempt logged. Every delivery is signed using HMAC-SHA256 with a user-provided whsec_ secret to allow server-side validation of authenticity. A real-time dashboard displays delivery success rates, allows inspection of failed messages, and supports one-click replay. Additional features include fan-out delivery to multiple destinations, idempotent delivery through an idempotencyKey to prevent duplicate processing, per-endpoint rate limiting that buffers traffic automatically, and a built-in test sink for inspecting payloads and signatures. Endpoints and messages can be grouped by application for easy switching. A WordPress and WooCommerce plugin is available to convert standard WooCommerce and WordPress events into webhooks. Ploq is designed with GDPR compliance in mind, as webhook payloads often contain personal data. The infrastructure runs on OVHcloud in France, with no involvement of US hyperscalers, and data never leaves the European Union. Payloads are encrypted at rest using AES-256-GCM with unique per-organization keys. The service has no exposure to the US CLOUD Act, as all dependencies are EU companies under EU jurisdiction. A Data Processing Agreement (DPA) is provided, listing EU sub-processors: OVHcloud, Scaleway, and Mollie. Typical use cases include any application that needs to send webhooks to multiple receivers while maintaining high reliability and compliance with European data protection regulations. The workflow involves signing up with an email, creating an application container, configuring endpoints, and then sending webhooks through Ploq. The service manages retries, signing, and monitoring, while the user validates deliveries on their server using the provided Webhook-Id, Webhook-Timestamp, and Webhook-Signature headers to confirm authenticity and protect against replay attacks.