Strict tenant isolation
Every record carries a tenant id and every query is scoped to it. A client account can only ever read its own data.
Security
What protects your clients’ data
Every claim on this page is verifiable in the codebase. There are no certifications listed here, because we do not hold any — and a badge nobody audited is worth less than a sentence you can check.
Security measures
Checks run on our own infrastructure
No third-party monitoring API is involved, so your clients’ URLs are never handed to a vendor.
No probing of internal networks
Monitored targets are resolved before they are used, and private, loopback and link-local addresses are refused — when a site is saved, and again before every check.
Credentials handled carefully
Passwords are hashed with bcrypt. Reset links are single-use, time-limited and stored only as hashes. Repeated login attempts from one address are rate-limited.
Daily database backups
The database is backed up every day, and restoring from those backups is verified rather than assumed.
Admin access is on the record
Every “view as user” session an administrator opens is written to an audit log — who, whom, when and from where.
Something here you need in writing?
If your own client needs a specific answer about how their data is held, ask and you will get a straight one.