Skip to the content
Get access

Webhooks thatstay in Europe.

Publish one message. We sign it, deliver it to every endpoint your customers subscribed, retry what fails and keep the full trail. All of it runs on EU-owned infrastructure, with no US subprocessor in the data path.

Get access

Try it

One publish, three subscribed endpoints. One of them is having a bad day. A simulation in this page: nothing is sent.

POST /v1/apps/app_…/messages
{
"topic": "invoice.paid",
"consumer": "customer-42",
"payload": { "invoice_id": "inv_1001", "amount": 1250 }
}
202 Acceptedmsg_…
  • api.kargo.example/hooks200 OK
    94 ms
  • erp.noordzee.example/webhooks/in503 ERR200 OK
    131 ms
  • ops.velo.example/events200 OK
    212 ms
3 deliveries4 attempts1 retriesBilled: 1 message

EU hosting is a location. Sovereignty is a jurisdiction.

TibiHooks is a Dutch company, and every provider in the data path is EU-owned. Your event data answers to EU law. TibiHooks is made by tibisoft, a company registered in the Netherlands.

EU-owned, EU region (Germany)
  1. Your apppublishes a message
  2. APIeu.api, accepts and stores
  3. PostgreSQLpayloads encrypted per tenant
  4. Queuecarries ids only, never payloads
  5. Delivery workerssign, send, retry
  6. Your customerreceives a signed request
  • No US subprocessor in the data pathNo US CDN, e-mail, error tracking, analytics or support tool.
  • A data key per tenantEvery payload is encrypted with a key that belongs to one tenant only.
  • No payload screen for staffNo screen shows us a payload. An operator export with payloads needs a stated reason and is written to your audit log.
  • Evidence for your auditorsAn audit log of who changed what, and an export of your configuration and delivery log on request.

Where each provider answers to the law

ProviderJurisdiction2EU data residency
TibiHooksEuropean UnionEvery plan, hosted in Germany
SvixUnited StatesEU region; EEA DPA from the Professional plan
Hookdeck OutpostCanadaEU region from the Growth plan
Hook0FranceEvery plan, hosted in France1
ConvoyUnited StatesEU environment on the managed cloud, or self-hosted

1 Hook0 states that its CDN and DDoS protection is Cloudflare, Inc., a US company.

2 Where the provider is incorporated or, where its pages do not say, the law its terms are governed by.

Based on each provider's own public pages as of .

The parts you would otherwise build yourself

Sending a webhook is one HTTP request. Sending them reliably to hundreds of customers is a queue, a retry scheduler, a signing scheme, a log and a settings screen.

Signed the standard way

Every request follows the Standard Webhooks specification. Your customers verify it with an existing library, or with a few lines of PHP, Node.js or Python.

What your customer receives
POST /hooks HTTP/1.1
webhook-id: msg_2r8Kq0fYx4
webhook-timestamp: 1791532800
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=

A failing endpoint does not take the rest down

Failed deliveries retry on a schedule you set. After 10 failures in a row the circuit opens and we probe before sending more. An endpoint that fails for 5 days is disabled, and you hear about it.

Circuit open on erp.noordzee.example. Next probe in 5 minutes.
  • 503 ERRAttempt 12 140 ms
  • 429 BackoffAttempt 2, waited for Retry-After88 ms
  • 200 OKAttempt 3131 ms

A portal your customers use inside your app

Two script tags put endpoint and subscription settings in your own product. The loader is under 6 KB, sets no cookie and uses no browser storage. Prefer your own screens? Build them on the same API.

Your endpoints Embedded portal
  • api.kargo.example/hooksinvoice.paidinvoice.voidedHealthy
  • erp.noordzee.example/webhooks/ininvoice.paidCircuit open

Every attempt on record

Open any message and see each delivery, each attempt, the status code and the response time. Replay one delivery or everything that failed for an endpoint.

Payloadattempts3
{
"type": "invoice.paid",
"invoice_id": "inv_1001",
"amount": 1250
}
  • 200 OKapi.kargo94 ms
  • 200 OKops.velo212 ms
  • 503 ERRerp.noordzee2 140 ms
  • Replayederp.noordzee131 ms

An API you can build the whole thing on

REST and JSON under /v1
The dashboard runs on the same /v1 API.
Idempotency-Key on publish
Publish twice by accident and your customer still gets one webhook.
Errors as problem details
RFC 9457, each type documented with its cause and its fix.
Cursor pagination
Stable pages through logs that keep growing while you read them.
Operational webhooks
Endpoint disabled, circuit opened or closed, secret rotated: sent through our own pipeline.
Leave with your data
Your configuration and delivery log as an export, on request.

Pricing

Pricing coming soon.

One published message is one billed message, however many endpoints it reaches and however often we have to try again.

1 message, 12 deliveries and 3 retries are billed as 1 message.

Get access

Your first delivery takes three steps.

Create an application, add a consumer with an endpoint, and send your first message.

Get access
Publish a message
curl -X POST "https://eu.api.tibihooks.com/v1/apps/app_…/messages" \
-H "Authorization: Bearer whk_test_…" \
-H "Content-Type: application/json" \
-d '{"topic": "invoice.paid", "consumer": "customer-42", "payload": {"invoice_id": "inv_1001", "amount": 1250}}'