Security at isituprightnow
A monitoring service knows your infrastructure, your alert contacts and often your credentials for health checks. Here is how we protect them.
Your account
Hashed passwords
Passwords are stored only as salted hashes (ASP.NET Core Identity). Repeated failed sign-ins lock the account for 15 minutes.
Two-factor authentication
Protect your sign-in with an authenticator app (TOTP) and one-time recovery codes. Account owners can require 2FA for every member.
Sessions you control
Every browser and mobile sign-in is a session you can see and revoke in Settings → Security. Changing your password signs out the others.
Roles and audit log
Owner, Admin, Member and Notify-only roles limit what each person can change, and account changes are recorded in an audit log.
Your data
TLS everywhere
The website, dashboard, API and status pages are served over HTTPS only, through Cloudflare.
No card data on our servers
Payments are handled by our payment provider (Stripe or Paddle). Card numbers never touch our servers.
Secrets encrypted at rest
Credentials such as provider keys and monitor passwords are encrypted in the database and always masked by the API. API keys are stored only as hashes and shown once.
Daily backups
The database is backed up every day, so your configuration and history can be restored after a failure.
The platform
SSRF protection
Checks and webhooks only connect to public internet addresses. The address is verified after DNS resolution, at connection time, so private networks and cloud metadata endpoints are out of reach.
Abuse protection
Rate limits on sign-in, sign-up, the contact form and other public endpoints. Sign-up and contact forms support Cloudflare Turnstile bot checks.
Staff access
Staff use separate accounts with mandatory two-factor authentication, and every administrative action is written to an audit log.
Public by choice
Status pages show only the monitors you add to them. Protect a page with a password or hide it from search engines.
Responsible disclosure
Found a vulnerability? Please tell us privately before you tell anyone else. Send the details — affected URL or endpoint, steps to reproduce and the impact you expect — through the contact form with the topic "Security". Our contact details for researchers are also published in /.well-known/security.txt (RFC 9116).
Please test only against your own account, never access or modify other customers' data, and don't run denial-of-service or volume tests. We will confirm receipt, keep you informed while we fix the issue and credit you if you wish.