Security

Architecture

UptimeGlobe runs on a fully managed serverless platform operated by a tier-one infrastructure provider. There are no long-lived servers of ours, no SSH access to rotate, and no operating systems for us to patch — a large class of vulnerability simply is not part of our surface. All traffic, user-facing and internal, travels over TLS.

Your account

• Passwords are hashed with PBKDF2-SHA256 (100,000 iterations, per-user salt). We never store or log a plaintext password, and login responses are shaped so that account existence can't be probed by timing.
• Two-factor authentication (TOTP) is available to every account, free plan included.
• Sessions use a short-lived 15-minute token plus a single-use rotating refresh token. Reuse of an already-rotated refresh token — the signature of a stolen session — revokes every session on the account. Password changes and resets do the same.
• Bot protection: signup and login are screened for automated abuse without a CAPTCHA to solve.

Your credentials and data

• Notification credentials — Slack tokens, webhook URLs, SMS provider keys — are encrypted at rest with AES-256-GCM under a key held outside the database. The API returns them redacted, and error messages are scrubbed so a failing integration can't leak its own secret.
• Tenant isolation is enforced in the data-access layer itself: every query against tenant-owned data is automatically scoped to your organization, and our linters refuse code that bypasses that gateway. It is not left to each endpoint to remember.
• API keys are scoped per resource and per action (read/write), shown once at creation, stored hashed, and revocable at any time.
• Payment data: card details never touch our systems. When paid billing runs, checkout and card storage are handled by a dedicated payment provider.

Data rights

You can export your data and you can delete your account — deletion is a real hard-delete of your tenant's data, not a soft flag. Details in the privacy policy.

Compliance status

UptimeGlobe does not yet hold a SOC 2 or ISO 27001 certification — we're an early-stage, founder-run product and won't pretend otherwise. This page describes the real controls in place today; it is updated as the posture evolves.

Reporting a vulnerability

Found something? Use the contact form: choose the topic Something else and start your message with "SECURITY". Include steps to reproduce and the impact you believe it has. We'll acknowledge within 2 business days, keep you informed while we fix it, and credit you if you'd like. Please don't access other users' data while testing — a proof of concept against your own account is always enough.