Sending Notifications

Overview

A Send Notification action listens for the events you choose, such as a privacy request arriving, a scan finding issues, or your balance running low. When one happens, it sends a message to every destination you added:

• Email: people in your organization.
• Webhook: a signed POST request to your own system.

One notification can listen for several events and send to several destinations, and you can set up as many notifications as you like.

Notifications never carry a requester's personal details, such as their name or email address. Each message links back to Concord, where you can see them.

Plans and Permissions

Send Notification and email destinations work on every plan. Webhook destinations are on Concord Privacy Pro and up, or any paid Concord Trust plan. A destination your plan doesn't include shows the plan it needs. If you change to a plan without it, that destination stops sending, and Activity says why.

Owners and Admins can set up notifications, which needs permission to edit actions.

What It Costs

• 1 Action each time a notification sends, however many destinations it sends to. It's charged only when at least one destination gets the message.
• Billing alerts are free: Balance running low, Billing update, Self-learning skipped and Data Credits auto-purchased.
• Send Test and retries are free.
• When your organization has no Actions left, nothing is sent, and Activity says "Not sent: this organization has no Actions left."

See Actions and Data Credits for how Actions are counted and topped up.

Set Up A Notification

1. Go to Actions → Browse Catalog.

2. Open Send Notification and click Set Up.

3. Give it a Name.

4. Under Run When, pick the events it listens for. See Events.

5. Under How Often, pick how often it may send:

   Option	Sends
   Every time	Once for each event
   At most once every 15 minutes	Once per quarter hour, for each event and project
   At most once an hour	Once per hour, for each event and project
   At most once a day	Once per day (UTC), for each event and project
   At most once a week	Once per week, for each event and project

   The limits use fixed blocks of time, such as each hour on the clock, so two events either side of a boundary both send.

6. Under Send To, click Add Destination, pick where it goes and fill it in. Add as many as you need.

7. Leave Enabled on, then save.

Your notifications are listed under Actions → Your Actions, where you can edit, turn off or delete them.

Write Your Own Message

Each email destination has a message box. Leave it empty to send Concord's default message: the event's headline, its details and a link to it.

To write your own, type the message and click Insert Field to add details from the event. A field such as {{event.name}} is filled in when the notification sends.

A few things to know:

• Fields go exactly where you put them. Add spaces or new lines between them. {{event.name}}{{project.name}} sends "Privacy request receivedAcme Store".
• A message with no fields gets the default details below it. Once your message uses a field, it's sent as you wrote it.
• A field shows in red when none of the events you picked has it.
• Email also has an Email Subject, which can use fields too. It's always one line.

Test And Check Delivery

Click Send Test on a destination to send it a sample message right away. A test is marked as one, isn't charged, and isn't retried.

To see what was sent, go to Actions → Your Actions → Activity. Each run shows every destination with its outcome: delivered, or the reason it wasn't.

Retries And Limits

When a destination can't take the message because of a problem that may pass, Concord tries again after 1 minute, 5 minutes, 30 minutes and 2 hours. Such problems include a timeout, a server error, or a webhook answering 429 or 5xx. When a webhook answers 429 with a Retry-After header, that can make the wait longer, up to 2 hours.

Each retry uses the destination as it's set up at the time. So if you fix a webhook address, the next retry uses the fix.

A problem that won't pass on its own isn't retried. That includes a webhook answering a 4xx other than 429, or a redirect.

A notification sends at most 100 times a day (UTC). Billing alerts don't count toward that.

Webhooks

A webhook destination sends each event to an address on your own system as an HTTPS POST with a JSON body, signed so you can check it came from Concord.

The Address

• It has to start with https:// and use a hostname, not an IP address.
• It can't contain a username or password.
• It has to be reachable from the internet. Addresses on private networks are refused.
• Concord doesn't follow redirects, so use the final address.

Answer with any 2xx status within 10 seconds. Do any slow work after you've answered.

The Request

The body for a privacy request:

{
  "id": "6f1d2c3b-4a5e-4f60-8b7a-9c0d1e2f3a4b",
  "type": "compliance_requests.received",
  "createdAt": "2026-10-19T18:44:28.425Z",
  "data": {
    "event": "compliance_requests.received",
    "eventName": "Privacy request received",
    "title": "Privacy request received",
    "organizationId": "0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
    "organizationName": "Acme",
    "projectId": "1b2c3d4e-5f6a-4b7c-9d8e-0f1a2b3c4d5e",
    "projectName": "Acme Store",
    "entityId": "2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f",
    "properties": {
      "complianceRequestId": "2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f",
      "request": "delete"
    },
    "link": "https://admin.concord.tech/acme/privacy-requests/request-log?complianceRequestId=2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f"
  }
}

Verify The Signature

When you add a webhook, Concord makes its signing secret, which starts with whsec_, and shows it once. Copy it before you save: it's never shown again.

To check a request:

1. Take the raw body exactly as it arrived, before parsing the JSON. Most frameworks give you a parsed copy that won't match.
2. Join the x-concord-timestamp header, a ., and the raw body.
3. Compute an HMAC-SHA256 of that with your signing secret, as lowercase hex.
4. Compare it with the part of x-concord-signature after v1=, using a constant-time comparison.
5. Refuse the request if the timestamp is more than 5 minutes old, so a copied request can't be replayed. A retry is signed again with a new timestamp, so it passes this check.

Node.js, with Express:

import crypto from 'node:crypto';
import express from 'express';

const SECRET = process.env.CONCORD_WEBHOOK_SECRET;

function isFromConcord(rawBody, headers) {
  const timestamp = headers['x-concord-timestamp'];
  const signature = headers['x-concord-signature'] ?? '';
  if (!timestamp || !signature.startsWith('v1=')) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
  const received = Buffer.from(signature.slice(3));
  return (
    received.length === expected.length &&
    crypto.timingSafeEqual(received, Buffer.from(expected))
  );
}

const app = express();
app.post(
  '/concord-webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    if (!isFromConcord(req.body.toString('utf8'), req.headers)) {
      return res.sendStatus(401);
    }
    const event = JSON.parse(req.body.toString('utf8'));
    res.sendStatus(200);
    // Handle the event after answering.
  },
);

Python:

import hashlib
import hmac
import os
import time

SECRET = os.environ["CONCORD_WEBHOOK_SECRET"]


def is_from_concord(raw_body: bytes, headers) -> bool:
    timestamp = headers.get("x-concord-timestamp")
    signature = headers.get("x-concord-signature", "")
    if not timestamp or not signature.startswith("v1="):
        return False
    try:
        signed_at = int(timestamp)
    except ValueError:
        return False
    if abs(time.time() - signed_at) > 300:
        return False
    expected = hmac.new(
        SECRET.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature[3:].encode(), expected.encode())

Duplicates

A retry carries the same id, the same x-concord-delivery-id and the same body as the first attempt. Only x-concord-timestamp and x-concord-signature change. Keep the IDs you've handled and skip any you've seen.

A Send Test's id starts with test-.

Rotate The Secret

1. Edit the notification and click Rotate Secret on the webhook.
2. Copy the new secret it shows.
3. Save, and update your system with the new secret at the same time.

From the save on, requests are signed with the new secret only. A webhook with no secret shows Requests are not signed. Click Add Signing Secret to start signing it.

Webhooks Added Before Signing Version 1

A webhook added before Concord signed with v1 keeps its original format, so your system doesn't break:

• The body is the event's details alone: what sits under data above, with no id, type or createdAt around it.
• x-concord-signature is the HMAC-SHA256 of the raw body alone, as hex, with no v1= and no x-concord-timestamp.

To move one to v1, remove the webhook destination and add it again with the same address, then update your system.

Events

The billing events are free to send. See What It Costs.

Troubleshooting