What we do to protect accounts, monitors and check history. No marketing promises — concrete on every point.
To anyone. Ever. Email addresses and monitor URLs are for providing the service, not for ads or resale.
There's no analytics or third-party scripts in the dashboard or admin panel. They're only on the public pages of the site (Yandex.Metrika for traffic estimation).
Personal data processing is described in the Privacy Policy. Any user can request an export, change or deletion of their data.
All traffic between the browser, the bot and our API goes over TLS 1.2/1.3. Certificates renew automatically — you won't see an expired SSL on our side.
Passwords are never stored in plain text. We use bcrypt — an industry standard with adjustable cost. Recovering the original password from the database is impossible, even for service staff.
Login, registration and password-reset attempts are limited per IP and by an overall cap. Password guessing or mass email harvesting becomes impractical even with automation.
All email addresses are verified via a link. An account without a verified email won't get critical notifications — this protects against signing up with someone else's mailbox.
The database is backed up regularly. Backups are stored separately from the main infrastructure and tested for recoverability.
Administrator actions and important system events are logged with the user, IP and time. This makes it possible to investigate incidents and spot anomalies.
The service's components run in separate Docker containers with minimal privileges. Agents on user VPS use a pull model — we don't open inbound ports on your server.
We use UptimeDog to monitor UptimeDog. If the main service goes down, we find out first, and it's visible on the public status page.
If you've found a security issue — please don't publish it before we've had a chance to fix it. Write directly and we'll respond promptly. Responsible disclosure is rewarded with a mention in credits (if you'd like).
Report via email