Security

Secrets and test logins

A journey that signs in needs a password for your site. We ask for a test account made for the purpose, never a real customer's, and we treat it as the most sensitive thing we hold:

• It is encrypted with AES-256-GCM before it is stored. The encryption key lives in the server's environment, not in the database.
• Each value is bound to its owner and its purpose, so an encrypted value copied elsewhere does not decrypt.
• It is never shown again after you save it, to you or to our administrators.
• It is only ever typed into the sign in page of a site you have verified as yours.
• It is never sent to an AI provider.

Proving a site is yours

Uptime checks work on any public address, but anything that goes further, journeys, test logins, WordPress data, needs proof that the site is yours: a DNS record, a file at a given address on the site, or the WordPress plugin connected from inside the site's admin.

The monitoring browser

Journeys and visual checks run in a real browser on our servers. It is fenced in:

• Each check gets a fresh browser session, closed when the check ends. Nothing carries over between sites or customers.
• Every request it makes, including every redirect and every image or script a page loads, is checked first. Private, loopback and link-local addresses are refused, so a page cannot use our browser to reach internal networks.
• The browser shuts down when idle, and is replaced if it stops responding.

Accounts and access

• Passwords are hashed with bcrypt and never stored or logged in readable form.
• Sign in, sign up and the contact form are rate limited and protected by reCAPTCHA.
• The session cookie is HttpOnly, sent only over HTTPS, and limited to our own site.
• The service refuses to start in production with a weak session secret.
• Changes to payment and email settings are recorded in an activity log, with secrets shown only as "set" or "not set".

Payments

Card payments go through Stripe or United Bank Limited's payment gateway. You type card details on their pages, not ours. A payment is only marked as paid after we confirm it with the gateway itself, and a payment that does not match its invoice is held for a person to check.

What is public

Nothing about the sites we watch is published unless you choose to. The live figures on our home page are counts and averages computed in the database, so they cannot name a site. Status pages show only what their owner chooses, and an unlisted page cannot be found by guessing. Retention periods are in the privacy notice.

Reporting a vulnerability

If you think you have found a security problem, write to our contact page with "Security" in the subject. Please include:

• what you found and where;
• the steps to reproduce it;
• what an attacker could do with it.

Please give us a reasonable time to fix it before telling anyone else, and do not access other customers' data, run denial of service tests, or use automated scanners against the service. We will reply, keep you updated, and credit you if you would like.