> ## Documentation Index > Fetch the complete documentation index at: https://docs.nylon.dev/llms.txt > Use this file to discover all available pages before exploring further. # What Nylon stores > Social credentials, API keys, request logs and webhook payloads — how each is held and what removing them does. Nylon sits between your application and every social network, so it necessarily holds credentials. This is what it keeps and how. ## Social account credentials The tokens a network issues when a user authorizes an account are stored **encrypted with AES-256-GCM**. Each ciphertext is bound to what it was sealed for and to the organization that owns it, so a stored blob cannot be unsealed as something else or replayed into another organization's record. Bluesky is a special case worth knowing: Nylon exchanges the app password for a session immediately and **never stores the password itself**. **Disconnecting an account destroys its stored credential.** It is cleared in the same transaction that marks the profile disconnected — there is no soft-deleted copy kept for a possible reconnect. That is Nylon's side. Only the network itself can forget that it once issued a credential, so if you want access fully revoked, also remove Nylon from that account's connected-apps list. See [Disconnect an account](/help/disconnect-an-account). ## API keys A key is **hashed with SHA-256** before it is stored. Nylon keeps the first 18 and last 4 characters in clear, which is what the masked value on the API page is built from, and nothing else. This is why a key is shown once and cannot be recovered: Nylon does not have it. Lose one and the only option is to revoke and replace it. ## Webhook signing secrets Encrypted with the same scheme as social credentials, because unlike an API key a signing secret has to be **recoverable** — you cannot produce an HMAC signature from a hash. Like API keys, a signing secret is displayed once, on creation and on rotation. ## Request logs Every API request is recorded with its method, path, status, duration, and its **full request and response body**. Before a body is stored, anything that looks like a credential is redacted: any field whose name contains `authorization`, `password`, `secret`, `token`, `api key` or `credential` is replaced with `[REDACTED]`, at every level of a nested object. Everything else is stored as sent — post text, media URLs, profile identifiers. If your post bodies would carry personal data beyond that, know that it is in the log. ## Webhook payloads Each delivery stores the payload Nylon sent and the response body your endpoint returned, so you can inspect either from the delivery log. Deleting a webhook endpoint deletes its entire delivery history with it. ## Your own data Your name and email, your organization's name and icon, and your team's membership. Payments run through Stripe — card details are held by Stripe, not by Nylon. ## Removing things | To remove | Do this | Effect | | -------------------------------- | ----------------------- | ----------------------- | | One social account's credentials | Disconnect it | Immediate, irreversible | | One API key | Revoke it | Immediate, irreversible | | One webhook's history | Delete the endpoint | Immediate, irreversible | | Everything | Delete the organization | Permanent | For data requests beyond these, email [support@nylon.dev](mailto:support@nylon.dev). ## Related Where keys belong, and rotating them. What is destroyed, and what to revoke at the network.