Security, stated plainly.

Passwords are at least 10 characters and stored as scrypt hashes, never in plain text. A reset link works once, for one hour, and setting a new password signs out every other device.

Codes from an authenticator app, with one-time backup codes, on every plan. With two-factor on, sign-in links by email are no longer sent.

Email and password, a one-time sign-in link by email that works for 15 minutes, Google or GitHub. Every account confirms its email address, and a provider account only joins an existing one when the provider says the address is verified.

A session lasts 30 days and is renewed while you use the app. Account lists every device that is signed in, and you can sign any of them out. Sign-in attempts are rate limited.

Owner: everything, including billing and deleting the workspace. Admin: members, projects and all monitoring. Member: monitors, status pages and alerts. Viewer: read-only. The server checks the role on every change.

An owner or admin can require two-factor authentication. Members who sign in with a password then set up an authenticator app before they can open the workspace; Google and GitHub sign-ins rely on the provider’s own two-factor.

Changes to monitors, members, billing and API keys, with who made them and when. Owners and admins can read it and export it as CSV.

Each key is read-only or read and write, belongs to one workspace and is limited to 120 requests a minute. A write key stops writing when the person who created it is no longer an owner or admin.

Client dashboards give a client read-only access to one project with their own sign-in. They see uptime and incidents, never monitor settings, tokens or private targets.

Webhook alerts carry an HMAC-SHA256 signature, so your own systems can check that they came from Uptimecheck.

Uptime, response times and incidents are kept 1, 2 or 3 years on Start, Professional and Business, then deleted. Every single check, with its details, is kept 30 days on every plan, and incident screenshots 90 days.

Deleting a workspace removes its projects, monitors, status pages and history and cancels its subscription. Deleting your account is confirmed by a link sent to your email. Deleted data leaves our backups as they expire, within 30 days.

Status page statistics count visits by country, referrer and device without cookies, and IP addresses are never stored.

Checkout and the billing portal are hosted by Stripe. Card details go straight to Stripe; we never see or store card numbers.

Each change runs linting, type checks, unit tests, Go tests and the full end-to-end suite. Only builds that pass reach the server, and a deploy that fails its health check rolls back by itself.

We check dependencies with pnpm audit and ship security releases as they come out, such as the Next.js 16.4.2 fixes in October 2026.

The server accepts SSH keys only, never passwords. Production secrets live on the server, never in the code repository.

Every address a check or webhook connects to is checked against private and internal ranges, also after the DNS lookup, so monitors can’t be used to probe internal systems.

The server agent only installs releases signed with our ed25519 key, and never an older version than it runs.

An independent watchdog on Cloudflare checks the app’s health every minute and alerts us by email and SMS when something fails.