Security at UptimeIO

How we protect accounts and data, and how to report a vulnerability.

Last updated: September 30, 2026

What protects your account and data

Encryption

Traffic to UptimeIO is encrypted with TLS. Webhook signing secrets are encrypted at rest with AES-256-GCM, and passwords are hashed with bcrypt.

EU-Based Data Storage

Your account data is stored on our application server, located within the European Union. See the Privacy Policy for the providers we use.

Access Controls

Role-based access control lets you limit what each team member can see and change. It is available on Pro and Scale; the Free plan has a single owner.

Nightly Backups

A nightly database backup is uploaded to separate object storage in Paris, France. Data written between two backups is not covered.

Two-Factor Authentication

Two-factor authentication is available for every account on every plan.

Vulnerability Reports

Report a suspected vulnerability to [email protected]. We acknowledge reports within 48 hours.

Security practices

The controls we can describe specifically.

Infrastructure

Application and database hosted on a single server in the European Union, with monitoring probes running separately from Amsterdam, US West, and Singapore
Rate limiting on API endpoints
Database access is split into separate roles for the API and background jobs

Application

Schema validation of API request data
Security headers on API responses
Short-lived access tokens with refresh tokens, or API keys for programmatic access
Webhook requests to your endpoints can be signed with HMAC-SHA256 so you can verify they came from UptimeIO

Data

Passwords hashed with bcrypt
Webhook signing secrets encrypted at rest with AES-256-GCM
We collect only what is needed to run the service, as described in the Privacy Policy
Account data is purged within 30 days of account termination on request

Data protection

How we handle personal data.

GDPR

You can request access to, correction of, export of, or deletion of your data by emailing [email protected]. Our application server is located within the European Union.

Data processing

We share data only with the service providers listed in our Privacy Policy.

Responsible Disclosure

We take security seriously and appreciate the work of security researchers. If you discover a security vulnerability, please report it to us responsibly.

Email your findings to [email protected]
Provide sufficient detail to reproduce the issue
Allow reasonable time for us to address the vulnerability
Do not access or modify other users' data

We commit to acknowledging reports within 48 hours and working with researchers to address valid vulnerabilities promptly.

Security Questions?

If you have questions about our security practices or need additional information for your security review, please contact us.

Contact Security Team