Security

Overview

Halyard stores your payloads and runs code that touches your production systems, so security is part of the product, not a separate tier. Everything on this page is available on every plan unless it says otherwise.

Encryption

Your data is encrypted whenever it moves and wherever it is stored. There is no setting to turn this off, and no extra cost.

In transit

The API, the dashboard, worker connections and webhook deliveries all use TLS 1.2 or 1.3 with modern cipher suites only. Plain HTTP requests are refused, not redirected, so a key sent over HTTP by mistake never travels further than the first hop. Between our own services, traffic is encrypted with mutual TLS.

At rest

Job payloads, event data, logs and backups are encrypted with AES-256-GCM. Each project has its own data key, which is itself encrypted by a master key held in a hardware security module and rotated every 90 days. On the Enterprise plan you can bring your own master key and revoke our access to it at any time.

Data residency

Choose a region when you create a project. Jobs, payloads, events, logs and backups for that project are stored and processed only in that region. The region can't be changed later; to move, create a new project and drain the old one.

Point the SDK at your region with the region option, as shown in each SDK guide. A request sent to the wrong region fails with permission_denied rather than being forwarded.

IP allowlist

Restrict any API key to the addresses your servers use. Requests from anywhere else fail with 403 permission_denied, even with a valid key, so a leaked key is useless outside your network. Allowlists take IPv4 and IPv6 CIDR ranges, up to 50 per key, and changes apply within a minute.

curl https://api.halyard.example/v3/keys/key_5Wd2Jm8Pq4 \  -X PATCH \  -H "Authorization: Bearer hy_test_51Hq8Zx2rTmV9cKpL3d" \  -H "Content-Type: application/json" \  -d '{    "allowed_ips": ["203.0.113.0/24", "2001:db8:4f2::/48"]  }'

Webhook source IPs

If your firewall only accepts known senders, allow the addresses Halyard delivers webhooks from in your project's region. We announce changes in the changelog at least 30 days ahead.

Audit log

Every change to your project is recorded: who or which key made it, from which IP, and what changed. That covers keys, members, roles, queues, schedules, webhook endpoints and project settings, as well as job cancellations and dead-letter purges.

{  "id": "aud_7Kp2Qx9Lm3",  "action": "api_key.created",  "created_at": "2026-10-12T14:08:51Z",  "actor": {    "type": "user",    "email": "priya.nair@northwind.example",    "ip": "203.0.113.42"  },  "target": { "type": "api_key", "id": "key_5Wd2Jm8Pq4" },  "changes": {    "scopes": ["jobs:write", "events:write"],    "allowed_ips": ["203.0.113.0/24"]  }}

Secrets in payloads

Job payloads are encrypted at rest, but they are also visible to anyone in your project who can view jobs, and they appear in logs, webhook deliveries and the dashboard. Treat a payload like a log line: no passwords, tokens or card numbers.

// Don't: the secret is stored with the job and shown in the dashboard.await halyard.jobs.create({  queue: "integrations",  task: "sync-crm",  payload: { account_id: "acc_31Fz", api_token: crmToken },}); // Do: pass a reference and look the secret up inside the worker.await halyard.jobs.create({  queue: "integrations",  task: "sync-crm",  payload: { account_id: "acc_31Fz", credential: "vault:crm/acc_31Fz" },});

# Don't: the secret is stored with the job and shown in the dashboard.halyard.jobs.create(    queue="integrations",    task="sync-crm",    payload={"account_id": "acc_31Fz", "api_token": crm_token},) # Do: pass a reference and look the secret up inside the worker.halyard.jobs.create(    queue="integrations",    task="sync-crm",    payload={"account_id": "acc_31Fz", "credential": "vault:crm/acc_31Fz"},)

When a secret really has to travel with the job, use a sealed field. It is encrypted on your machine with a project key that Halyard Labs never sees, stored as ciphertext, redacted everywhere and decrypted only by your worker.

const job = await halyard.jobs.create({  queue: "integrations",  task: "sync-crm",  payload: { account_id: "acc_31Fz" },  sealed: { api_token: crmToken }, // encrypted with your project key, never logged}); worker.task("sync-crm", async (job) => {  const { api_token } = await job.unseal(); // decrypted only inside your worker});

Compliance

Request the SOC 2 report, our penetration test summary and the subprocessor list from the dashboard under Settings → Compliance, or write to trust@halyard.example.

Responsible disclosure

If you believe you have found a security issue in Halyard, please tell us before anyone else. Email security@halyard.example with the steps to reproduce it. Encrypt sensitive details with the PGP key published at halyard.example/.well-known/security.txt.

• We acknowledge reports within one business day and keep you updated until the issue is fixed.
• We won't take legal action against good-faith research that follows these guidelines.
• Test only against your own projects, and don't access, change or delete other customers' data.
• Valid reports are eligible for a reward of up to $10,000, depending on severity.