SECURITY

Controls, not badges.

UptimeLoop publishes the controls implemented in the product. It does not claim a certification, audit report or compliance badge it does not have.

Monitor target isolation

HTTP and HTTPS monitors accept only public targets. The service rejects private, loopback, link-local, reserved and credential-embedded destinations. DNS resolution is checked before each request, and redirect destinations are validated again to reduce server-side request forgery risk.

Authentication

Passwords are stored as salted scrypt hashes. Browser sessions are HMAC-signed, expire after 7 days and are checked against a server-side session version. Logging out increments that version so the current session cannot be replayed.

Login and registration requests require a same-origin browser request, have bounded JSON bodies and use PostgreSQL-backed rate limits. Login responses do not reveal whether an email address exists.

Public output

Automatic incident messages are converted into bounded public explanations. Raw Node.js messages, stack traces, system error codes, internal hostnames and network addresses are removed before public display. Authenticated diagnostics are also bounded and sanitized.

Availability versus probe health

UptimeLoop separates a confirmed target failure from a clearly local monitoring failure. A probe failure is stored for diagnosis but does not change the target state or reduce availability. This rule is conservative: HTTP status mismatches, target timeouts and target refusals remain target failures.

HTTPS trade-off

HTTP availability accepts the TLS connection independently of local certificate-chain trust, while a separate daily certificate probe records the presented certificate and its expiry date. This prevents local trust-store behavior from opening false application incidents, but it also means the availability state and certificate state must be read together.

Operational limits

UptimeLoop does not claim SOC 2, ISO 27001, penetration-test certification, encrypted application fields, multi-region probes, two-factor authentication or a formal service-level agreement. A public security-reporting inbox is not currently published; use the contact form without including secrets.