Security

What we do

• Sign-in is handled by the site that hosts this service; this app holds no passwords. Admin sign-in requires two-factor authentication.
• API keys, webhook addresses, bring-your-own keys and staff email addresses are encrypted at rest with AES-256-GCM. Everything travels over TLS.
• Every admin action, data export and impersonation is written to an append-only, hash-chained audit log that is verified daily.
• Our scanner refuses private, loopback, link-local and cloud metadata addresses, re-checks after every redirect, and uses only ports 80 and 443. It identifies itself and respects robots.txt.
• Inputs are validated on the server, outputs are escaped, and vendor HTML is sanitised and never rendered inside our pages.
• Public tools are rate limited per connection and protected against automation.
• Backups are encrypted and stored off site; restores are tested.

Report a vulnerability

If you find a security problem in this service, email the address on the Contact page with Security in the subject, or use the security.txt file at /.well-known/security.txt. Tell us what you found and how to reproduce it. We acknowledge within two business days, keep you informed, and credit you if you want. Please do not access other people's data or disrupt the service while testing.

Our own status

Our own uptime is measured by the same checker we use for you and shown on the status page for alertmybusiness. Last updated 2026-10-26.