Read-only by design
The guarantee
Midwatch only ever issues GET requests against your n8n API. There is no code path that writes: it cannot edit a workflow, execute a run, toggle active state, or delete anything. This is enforced in the connector itself, not by promise.
What we store / what we never store
What we store
- + Workflow metadata (names, ids, active state, definition hashes and normalized definitions for drift diffs)
- + Execution rollups (counts, statuses, timestamps)
- + Alert history
What we never store
- - Execution payload bodies
- - The business data flowing through workflows
- - Credential values or secrets
How your API key is held
Keys live as platform secrets on Cloudflare, referenced by name from the database (api_key_ref pattern) - the key itself is never stored in a database row, never logged, never rendered.
Tenant isolation
Every row is org-scoped with row-level security. Client-mapped views mean an agency's clients are separated inside the org too.
Report share links
A client report link is an unguessable token. Only approved reports resolve; drafts and unknown tokens 404 identically, and every share page carries noindex headers - a guessed URL leaks nothing and search engines index nothing.
Data deletion
Ask and it is gone: we delete an org's rows on request, and the read-only design means there is nothing of your business data to delete beyond monitoring metadata.
Questions
Ask us anything about how Midwatch handles your fleet's data.