Security

Concrete mechanisms instead of declarations

By its nature, monitoring receives addresses, test login credentials and screenshots of your site. Below is what we do with them, so that your security team can assess it without calling a meeting.

Data in the European Union

The production instance runs on a server in Germany (netcup GmbH), inside the European Economic Area. That is where the database with the customer's monitoring lives. Data leaves the EEA only when the customer switches on a feature that uses an external provider: SMS, Slack, Microsoft Teams or generating scenario steps with AI. The privacy policy lists them all. Moving the instance to a data centre in Poland is planned: we will announce it when it happens, not before.

Secret encryption

Passwords for alert channels, integration keys and scenario credentials are encrypted in the database with AES-256-GCM. The panel never shows a stored secret, only whether it has been set.

Isolated scenario execution

Scenario code runs in a child process with an environment cut down to the bare minimum. It cannot see the session signing key, the database encryption key or the database connection string. Even if the scenario itself were prepared maliciously.

Session and access

The session lives in an httpOnly cookie with SameSite=Strict. The token is not returned in the response body and is not reachable by scripts in the browser. Blocking an account invalidates running sessions immediately, not at the next login.

Roles and accountability

Four roles with increasing permissions: Owner, Administrator, Member, Observer. Every settings change goes to the audit log together with its author. Platform operator access is separated from customer accounts. One login has exactly one role.

Failure artefacts

Recordings, screenshots and HAR files are available only through a short-lived token limited to a single check. We save HAR without response bodies, so the diagnostic material does not become a copy of your site's data.

Operations
BackupsAn automatic database dump, verified right after it is created. A truncated copy fails the check and does not pass as valid.
RetentionFailure artefacts 14 days, check results 90 days (longer in higher plans). The incident history is never deleted, because the SLA for years back is calculated from it.
Rate limitingA request limit counted per client, resistant to spoofing the source address header. The API port is not exposed outside the server.
Security headersA full set of protective headers at the proxy layer; the panel and the API share an origin, so the token never travels between domains.
Certificate alertsSSL/TLS certificate expiry is a separate check type: for your certificate, but also for ours.
Data exportYou can export the monitoring configuration to a file at any time, including when you cancel. No call with a retention team.

What we do not have yet

We do not hold ISO 27001 certification or a SOC 2 report, and we do not intend to suggest otherwise. We also do not run a public status page or a bug bounty programme. If your purchasing procedure requires any of these documents, say so at the start of the conversation. We will save each other two weeks.

Need a data processing agreement, a completed security questionnaire or a call with a technical person? We reply the same working day.