Uptime monitoring security and how we handle your data
A monitoring account holds the map of your production systems: URLs, hostnames, ports, API endpoints and sometimes the tokens needed to reach them. This page explains how UptimePilot protects that information, who can access it inside your account and what happens to it when you leave.
Encryption in transit and at rest
All traffic between your browser and UptimePilot uses HTTPS with current TLS versions. Account data, monitor configuration and check results are stored encrypted at rest. Backups are encrypted the same way.
Stored API tokens encrypted and masked
API checks often need an authorization header or a token in the request. UptimePilot stores those values encrypted, uses them only to run your checks and shows them masked in the account after you save them. Anyone who can view the monitor sees that a secret is set, not the secret itself. We recommend a dedicated read-only token for monitoring, so it can be rotated without touching production credentials. More on api monitoring.
Access control and roles
Every account has roles that decide who can create and edit monitors, change alert rules, manage status pages and billing, or only view. Groups keep monitors separate per client or project, which matters for agencies that give clients view access to their own results. Members are invited by email and confirm their own address before they get access.
SSO with SAML on Enterprise
Enterprise accounts can require single sign-on through your identity provider with SAML. Access then follows your own joiner and leaver process: when someone leaves the company and loses access to your identity provider, they lose access to UptimePilot too.
Audit log on Enterprise
Enterprise includes an audit log of account activity: who created, changed, paused or deleted a monitor, who edited an alert rule or a status page, and when. It answers the question "who turned off that alert" during a review.
Your monitor data is yours
Monitor configuration and check results belong to your account. We use them only to run the service for you, to send your alerts and to build your reports. We never sell monitor data and never use it for advertising.
Data history per plan
Check history is kept for 90 days on Starter, 1 year on Team, 2 years on Business and 3 years on Enterprise. Older results are removed on a rolling basis. See uptime monitoring pricing for plan details.
Deletion on request and account closure
You can delete any monitor at any time, and its history goes with it. When you close your account, your monitors, check results, status pages and team data are deleted. You can also ask for deletion by writing to [email protected]. Billing records we are required to keep by law are retained only for that purpose.
Demo checks reach only public addresses
The public website uptime test runs real checks, so it is built to resist abuse. After DNS resolution, UptimePilot blocks private, loopback, link-local and reserved IP ranges, refuses redirects that lead into those ranges, uses only ports 80 and 443, and stops each check after 10 seconds. Demo checks are limited per address per day. This keeps the tool from being used to probe internal networks.
Monitoring only what you are allowed to monitor
Our terms of service allow monitoring only of endpoints you own or are authorized to monitor, and forbid load testing. Check traffic is light by design: one request per interval per monitor.
Responsible disclosure
If you believe you have found a security issue in UptimePilot, write to [email protected] with a description, the steps to reproduce it and the impact you observed. Please give us reasonable time to fix it before any public disclosure, and do not access other customers' data or disrupt the service while testing. We confirm receipt and keep you informed as we work on a fix.
01
Is my data encrypted?
Yes. Data is encrypted in transit with HTTPS and at rest, including stored API tokens, which are also masked in the account.
02
Can I require single sign-on for my team?
Yes, on Enterprise, with SAML through your identity provider.
03
Who can see the tokens I add to API checks?
Nobody in your account can read them back after saving. They are shown masked and used only to run the checks.
04
What happens to my data when I cancel?
Your plan stays active until the end of the paid period. When you close the account, monitors, results, status pages and team data are deleted.
05
Do you sell or share monitoring data?
No. Monitor data is used only to run the service for your account and is never sold.
Monitor production with clear controls
Roles, encrypted secrets and clear retention on every plan, with SSO and an audit log on Enterprise.