How this service looks after itself

Report a security problem

If you find a security problem in this service, email [email protected]. Please don't test against other people's accounts.

Accounts

• Passwords are stored only as a scrypt hash, so I can't read yours.
• Signing in sets a session cookie that lasts 12 hours. JavaScript can't read it.
• Two-factor sign-in with an authenticator app exists, but you can't switch it on yourself in the panel yet. Ask me to enable it.
• Every new account is approved by hand.

Keeping one client's data from another

A client account can reach only an allowed list of panel routes, and each one works out which client you are from your session, not from anything your browser sends. Each server's agent has its own token, so one server can't file reports for another.

The server agent

It's optional, and it's only for server monitoring. It opens no port and accepts no connection. It runs on a timer, sends one report out, and stops. It does run as root, because it reads files like the SSH log. You can read exactly what it sends before you decide.

The free checks

They make public requests only: no port scans and no login attempts. They refuse private and internal addresses, and they apply that to redirects too.

Payments

Billing is by invoice. There's no card form, and no card details are collected.

Backups and how long things are kept

The database is copied every night, and each copy is kept for 14 days. How long each kind of data stays is on the privacy page.

What isn't in place

• It's one rented server, in one location, run by one person. If that server has a bad day, so do the checks.
• There's no certification and no outside audit of this service.
• Nobody is watching a screen overnight. Alerts are sent by a program whenever a check finds something, and people reply in working hours.
• This service doesn't block attacks on your site, because it isn't a firewall.