DiffHook
DiffHook watches web pages, JSON APIs, sitemaps and RSS feeds, then pushes a structured page.changed webhook the moment content shifts. Signed delivery, CSS selectors, AI alert modes and Slack, Discord or Telegram routing are included.
What is DiffHook?
DiffHook is an API-first web change monitoring platform. The unit of work is the monitor: a URL, a check interval and a destination. DiffHook polls that URL on schedule, diffs each snapshot against the previous one and, when something actually changes, fires a structured page.changed event carrying the monitor id, the URL, an ISO 8601 timestamp and the new normalised content. That event is the product. The publisher's stated argument is that rival tools were designed around a dashboard with notifications bolted on afterwards, and that the webhook should never have been the premium extra.
Four source types are covered on every plan: web pages, JSON APIs, sitemaps and RSS or Atom feeds. Monitoring can span a whole page or a single element picked out with a CSS or XPath selector, which is how a price, a policy clause or a status badge gets watched without the surrounding navigation generating noise. Smart comparison filters discard cosmetic changes, and AI alert modes qualify what changed against four intents: price, availability, new items or a custom prompt.
Delivery is where the documentation goes into unusual depth. Webhook endpoints are unlimited on all plans and signed with HMAC. A failed delivery is retried up to ten times on an exponential backoff running from one minute to roughly eight and a half hours, a delivery counts as successful when the endpoint returns 2xx within ten seconds, and every attempt lands in an immutable log with the before and after snapshots attached. Beyond raw webhooks, changes route natively to Slack, Discord, Telegram, email, Google Sheets, Microsoft Teams, Jira and an RSS server, or into n8n, Make, Zapier and Pipedream.
Check frequency and volume are what separate the tiers, from fifteen-minute polling on Starter down to one minute on Business, with log retention stretching from thirty days to a year and SSO appearing at the top. A REST API with a public OpenAPI specification is included from the first paid plan. The service is built and operated by KupaLabs FZCO, a small Dubai-registered company that describes itself as an indie micro-SaaS and says it monitors its own competitors with the tool.
What it does
- Watch any public URL and detect every content change, whole page or single element
- Monitor JSON API responses, sitemaps and RSS or Atom feeds alongside plain HTML
- Narrow monitoring to a price, a clause or a status badge with CSS or XPath selectors
- Filter out cosmetic and layout noise, and qualify changes with AI alert modes
- Deliver a signed page.changed event to a webhook, Slack, Discord, Telegram, email or Google Sheets
- Create, pause, resume and trigger monitors programmatically through the REST API
- Keep an auditable delivery history with downloadable before and after snapshots
When to use DiffHook / When not to
A quick filter to help you decide if DiffHook is the right fit.
When to use DiffHook
- Developers wiring change events into n8n, Make, Zapier or Pipedream workflows
- Revenue and product marketing teams tracking competitor pricing and packaging moves
- Legal, risk and compliance teams watching policies, filings and regulatory portals
- On-call and platform engineers monitoring vendor status pages, certifications and SLAs
- Solo developers and small agencies replacing home-grown scraping scripts with a managed service
When not to use DiffHook
- Anyone needing to monitor pages behind a login: the terms forbid URLs you are not authorised to access
- Consumers looking for a personal, household-use tool, since the service is contractually restricted to business and developer use and to adults over 18
- Teams that want a mobile app, a browser extension or a desktop client, as DiffHook ships only a web app and an API
- Organisations that require a certified provider, because the site claims to follow SOC 2 guidance without holding an attestation
- EU-regulated buyers who need European hosting by default, which here is only offered on request
How to use DiffHook
A typical end-to-end flow, from setup to results.
- Create an account; Starter opens on a 14-day free trial and the site advertises signup without a credit card
- Point DiffHook at the URL you want to watch, whether a page, a JSON API, a sitemap or an RSS feed
- Decide whether to track the whole page or add a CSS or XPath selector to isolate one element
- Pick a check interval, from 15 minutes on Starter down to 1 minute on Business
- Choose the destination: a per-monitor webhook, the workspace default webhook, or a channel such as Slack, Discord, Telegram or email
- For the API route, open Settings then API Keys and create a key, which returns a dh_live_ client id and a client secret
- Exchange that pair for a bearer token, valid for 24 hours, and send it on every request
- Call POST /api/monitors to create monitors programmatically, or use a monitor template
- Fire POST /api/monitors/{id}/trigger to force an immediate check and confirm the plumbing works
- Verify the HMAC signature on incoming webhooks, answer 200 within ten seconds, then process the payload asynchronously
Pros & Cons
Pros
- The webhook is treated as the core product and stays unlimited on every plan, rather than being priced as an add-on
- A complete REST API with a public OpenAPI specification is available from the entry paid tier
- Flat monthly pricing with no credits, no per-check metering and no overage billing
- Four source types are covered, where many competing tools only watch HTML
- Delivery guarantees are documented precisely: eleven attempts, published backoff intervals, signatures and a full log
- Legal documentation is unusually thorough for a micro-SaaS, with full privacy and terms texts, GDPR legal bases, SCCs and a DPA
- The interface ships in six languages and annual billing cuts 25 percent off the price
Cons
- Three pages of the same site describe three different free offers: a $0 plan with 5 monitors on the homepage, 3 free monitors on the alternatives page, and no free tier at all on the pricing page
- Plan quotas also disagree between pages, with the homepage claiming 50 and 500 monitors where the pricing page states 20, 100 and 500
- The subprocessor list promised in the privacy policy at diffhook.com/subprocessors returns a 404
- The terms contradict themselves on governing law: the summary says Delaware, the full text says the United Arab Emirates
- There is no independent certification; the site only says its practices follow SOC 2 guidance
- No Article 27 EU representative is designated even though the publisher sits outside the European Union, and EU-only hosting is available on request rather than by default
- The company keeps a very low public profile, with no social accounts, no named team and no third-party track record to check
Pricing & Plans
The homepage advertises a permanent free plan at $0 per month, limited to 5 monitors with daily checks and community support, although the pricing page itself lists no free tier. The cheapest paid entry point is the Starter plan at USD 12.00 per month, billed monthly and opening with a 14-day free trial. Annual billing reduces every paid plan by 25 percent.
- $0/month - 5 monitors
- daily checks
- community support (advertised on the homepage only)
- $12/month - 20 monitors
- 15
- 000 checks per month
- 15-minute polling
- 2
- 000 visual checks
- 2 seats
- 30-day log history
- $29/month - 100 monitors
- 150
- 000 checks per month
- 5-minute polling
- AI alert modes
- 10
- 000 visual checks
- 5 seats
- $79/month - 500 monitors
- 750
- 000 checks per month
- 1-minute polling
- 50
- 000 visual checks
- unlimited seats
- SAML and OIDC SSO
- quoted individually - private cloud
- single-tenant or on-premise deployment
- extra monitors from $1 per pack on Business
- extra visual checks from $5 per 10
- 000
- log storage at $5 per 100 GB
- 25 percent discount on all paid plans
Data, GDPR & hosting
A consolidated view of how DiffHook handles your data.
GDPR overview
Implementation is unusually detailed for a company of this size. The full privacy policy sets out its legal bases article by article, Article 6(1)(b), (f), (a) and (c), and says legitimate interest assessments are documented and available on request. A DPA under Article 28 is offered. International transfers rely on the European Commission's Standard Contractual Clauses or the UK IDTA. The eight data subject rights are listed with a 30-day response commitment, Article 8's 16-year threshold is applied in the EEA, and Article 22 automated decision-making is expressly excluded. Breaches are notified within 72 hours where feasible. Two gaps stand out: no Article 27 EU representative is named although the publisher is established in the United Arab Emirates, and the words GDPR compliant never actually appear.
Who owns the data?
Customers keep ownership of their own data. The terms grant DiffHook only a limited licence to host, process and transmit it in order to run the service, and section 10 explicitly carves customer data and Scraped Content out of the intellectual property DiffHook retains over its software, algorithms and branding. KupaLabs FZCO is the controller for account data and acts as the customer's processor under GDPR Article 28 whenever monitored pages carry third-party personal data, which the customer remains responsible for handling lawfully. Data is shared only with named subprocessors, never sold. Feedback about the product is the one exception: DiffHook may reuse it freely without compensation.
Reuse rights
Customers may reuse their own data freely, without asking permission. Change payloads are delivered straight to the endpoint they choose, delivery logs are queryable through the REST API, and the full before and after snapshots of any log can be downloaded. On termination a 30-day export window is opened before deletion. The limits sit upstream rather than downstream: monitors may only target URLs the customer is authorised to access, the customer warrants it holds the rights to the content it collects, and robots.txt is honoured as a matter of policy while the terms warn it carries no independent legal force. Reselling the service itself, as opposed to the data, requires written agreement.
Data retention & training
Hosting summary
No hosting country is committed to. The privacy policy states that DiffHook and its subprocessors may process data outside the user's own country, the United States included, and covers transfers out of the EEA, UK or Switzerland with the European Commission's Standard Contractual Clauses or the UK IDTA, with the documentation available on request. The homepage adds that EU-only hosting can be arranged on request for regulated customers, which makes European residency a negotiated option rather than a default. The site itself sits behind Cloudflare, whose anycast address gives no indication of where data actually rests, and no hosting provider is named. Subprocessors are described by category, with Stripe, Google Analytics 4, PostHog and Ahrefs named across the privacy and cookie policies; the promised full list at diffhook.com/subprocessors returned a 404 when checked. The publisher itself is established in the United Arab Emirates.
Things to keep in mind
Risks and trade-offs to weigh before adopting DiffHook.
- Monitoring a URL you are not authorised to watch is your legal exposure, not the vendor's: the terms push responsibility for computer access laws onto the customer
- Webhook payloads and logs can carry third-party personal data scraped from monitored pages, which makes you a controller for data you never chose to collect
- Honouring robots.txt is a policy here, not a legal shield, and the terms say so explicitly
- Delegating your watch to an alert feed erodes the habit of looking at the web yourself, leaving you blind to whatever the monitors do not cover
- Too many or too sensitive monitors produce noise, and noise trains people to ignore alerts, including the one that mattered
- AI alert modes interpret change: a badly framed prompt can flag the trivial or silently swallow the significant
- There is no guarantee of result; the terms disclaim that monitoring will be complete, accurate or timely, and abandoned deliveries are simply lost after eleven attempts
Setup & Integrations
Technical difficulty
Two very different levels. Without code, setup is genuinely easy: point at a URL, pick a channel such as Slack or email, and the site claims a first monitor runs in under five minutes with no engineer needed. The API route asks for more: create a key, exchange it for a 24-hour bearer token, and POST your monitor. Receiving raw webhooks requires an endpoint that answers 200 within ten seconds, and verifying the HMAC signature means writing a little code. CSS and XPath selectors assume you can inspect a page. Connecting through n8n, Make or Zapier avoids most of that.
Deployment
Integrations
Supported languages
Behind DiffHook
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement DiffHook.
Frequently asked questions
What can DiffHook actually monitor?
How often are pages checked?
How are alerts delivered, and what happens if my endpoint is down?
Is there an API, and is it included on every plan?
Is there a free plan or a free trial?
How much does the cheapest paid plan cost?
Where is my data hosted and how long is it kept?
Is a Data Processing Agreement available?
Which tools does DiffHook compare itself to?
Should you pick DiffHook?
DiffHook does one thing and states it plainly: it turns a change on a web page, a JSON API, a sitemap or a feed into a signed, structured event delivered to whatever system needs to act. The execution behind that promise is more rigorous than the price suggests. Delivery guarantees are spelled out attempt by attempt, snapshots are downloadable, the REST API and its OpenAPI specification are included from the first paid plan, and the pricing is flat with no credits or metered checks. For a developer wiring alerts into n8n or an on-call rotation watching vendor status pages, that combination is genuinely hard to find at $12 a month.
The reservations are about the vendor rather than the engineering. Three pages of the same site describe three different free offers, and the plan quotas on the homepage contradict those on the pricing page, which is an odd flaw for a company whose product exists to catch exactly that kind of silent inconsistency elsewhere. The subprocessor list promised in the privacy policy returns a 404. The terms name Delaware law in their summary and UAE law in the full text. And the security claim is carefully worded: practices follow SOC 2 guidance, which is not an attestation.
KupaLabs FZCO is a small, young Dubai company with no public team and no social presence, first archived in February 2025. None of that disqualifies it, and its legal documentation is more complete than most of its peers manage. But anyone planning to hang a compliance process on these alerts should verify the commercial terms directly and treat the absence of an Article 27 EU representative as a real question, not a formality.
- Choosing a selection results in a full page refresh.
- Opens in a new window.