Pipedream

Overview

Pipedream is a serverless workflow automation and integration platform that connects APIs and triggers event-driven processes between cloud services. Developers use it to build multi-step workflows that react to webhooks, scheduled events, or API polling triggers, transforming and routing data between services without managing infrastructure. Pipedream operates almost entirely server-side — its presence on websites is typically limited to webhook endpoints or embedded workflow trigger widgets.

What This Script Does

Webhook Trigger Endpoints

Pipedream's primary interface for websites is its webhook endpoint system. A website sends HTTP POST requests to a Pipedream-hosted endpoint (api.pipedream.com/v1/sources/{source-id}/events) to trigger a workflow. The payload contains whatever data the site chooses to send — form submissions, event data, or structured API payloads. The webhook trigger receives the data and routes it through the configured workflow steps.

Pipedream Connect (Embedded OAuth)

Pipedream Connect is a newer product that embeds an OAuth authorization flow directly in a third-party application. A JavaScript component loads the Pipedream Connect UI, allowing end users to authorize integrations (e.g., connecting their Google Calendar or Slack) without leaving the host application. This loads scripts from Pipedream's CDN.

Cookies Set

Pipedream sets no cookies in the standard webhook-trigger usage pattern. In the Connect embedded OAuth flow:

• pd_session — First-party session cookie set by Pipedream within the embedded iframe during OAuth authorization. Duration: session.
• pd_user — First-party persistent cookie within Pipedream's own domain context for authenticated Pipedream users. Duration: 30 days.

Domains Contacted

• api.pipedream.com — REST API and webhook endpoint receiver.
• pipedream.com — CDN for Pipedream Connect JavaScript components.
• connect.pipedream.com — OAuth authorization interface for Pipedream Connect embedded flows.

Data Collected Per Interaction

• In webhook mode: only what the site operator explicitly sends in the POST payload — Pipedream itself does not collect additional data from the end user's browser.
• In Connect mode: the user's OAuth authorization, connected account details, and the IP address of the authorization request.
• Pipedream logs workflow execution metadata (trigger time, step durations, success/failure) in the operator's Pipedream account.

Consent & Compliance

GDPR / ePrivacy: Pipedream's webhook trigger is a server-to-server call and involves no browser-side cookie setting or data collection from the end user. It therefore has no ePrivacy implications in standard webhook usage. Pipedream Connect's embedded OAuth flow may set session cookies and process the user's account credentials — this is functional processing directly requested by the user and does not require separate marketing consent. The data processor relationship between the operator and Pipedream should be documented in a DPA.

CCPA / CPRA: Pipedream processes data as a service provider under the operator's control. In webhook mode, it processes only what the operator explicitly sends. This is not a sale of personal information.

EU-US Data Privacy Framework: Pipedream is a US-based company. EU operators using Pipedream to process EU resident data should confirm Pipedream's Standard Contractual Clauses are in place.

Consent Category: Functional. Pipedream is an automation infrastructure tool with no advertising or behavioral tracking purposes.

Should You Block This Without Consent?

No. In standard webhook usage, Pipedream involves no client-side JavaScript and therefore has no consent implications from the user's browser perspective. In Connect mode, it performs a function explicitly initiated by the user (authorizing an OAuth integration). Neither use case constitutes marketing profiling or behavioral tracking requiring prior consent.