Every limit, published. Every cap, soft.

It depends which one, and every answer avoids losing your data. Storage caps evict oldest-first, the newest webhook is always stored; old ones age out. Rate limits answer senders 429 with a retry hint, and every throttled capture is counted where you can see it. Endpoint caps stop you creating more endpoints. If a downgrade leaves you over a cap, the downgrade answer below says exactly what is switched off. Oversized payloads are recorded as an honest trace with their true size, never silently dropped.

One HTTP request captured on one of your endpoints, any method, any content type, binary included. Replays don't create new stored requests; they re-deliver existing ones.

A downgrade takes effect at the end of the period you have paid for; until then you keep your current plan. When it takes effect nothing is deleted, but anything over the new plan’s caps is switched off: endpoints beyond the new endpoint limit (the oldest stay on), actions beyond the per-endpoint limit, API keys beyond the key limit (the most recently used stay on), and watchdogs beyond the watchdog limit, which are paused. Features the new plan does not include stop as well: notify actions switch off when the plan has no alert channels, and transformations stop applying below Pro. Senders posting to a switched-off endpoint get 410 Gone. Upgrade again and what we switched off comes back; anything you switched off yourself stays off. Retention and stored-request limits shrink only after a 14-day grace period, so nothing ages out or is evicted on the day of the change, and you can see exactly what expires when on every endpoint. No instant purges.

No metered overage, ever, that's a design decision, not a promo. When quota add-ons arrive they'll be fixed monthly line items you choose, capped well below the next tier. The bill you agreed to is the bill you get.

TLS everywhere, mandatory two-factor (passkeys supported) on every account, and forwarding targets are checked against private and internal ranges before a single byte is sent. Card numbers are masked in the dashboard’s payload viewer, and revealing one is a deliberate action your workspace records; payloads returned by the API and the export are not masked. Closing your account deletes your workspaces’ captured data (the privacy policy lists the few records we keep). Ask us anything via the contact page.

Create your account with GitHub, Google or email, turn on two-factor authentication, and name your workspace. An email sign-up adds one step before two-factor: open the verification link in the browser you signed up in, and it signs you in. Two-factor authentication is required on every account, Free included, for account security. If you picked a paid plan, you continue to billing details and checkout after the workspace name.

No. Free is the place to try the vault, with no card and no time limit. If a paid plan is not what you needed, ask within 14 days of the first payment on a new subscription and it is refunded in full. This applies once per customer; it is a way to try the paid plans without risk, not a recurring allowance. See the refund policy.

Paddle retries the card and emails you over the following seven days; the workspace keeps its paid plan throughout. If the payment has not gone through by the end of that window the subscription is cancelled and the workspace returns to Free, with the same 14-day data window as a downgrade. Updating the card at any point in those seven days keeps everything as it was.

Yes, effective at the end of the paid period, from the billing page, no email required. You can also close your account yourself from the Account page: a free workspace closes after 7 days, and a paid one runs to the end of the period you have paid for. Captured data is deleted on the closing date; the account record and billing records are kept (see the privacy policy).