Encryption. Isolation. Entitlement enforcement.
Capacity limits return 402 Payment Required with a structured upgrade payload — no silent failure, no surprise overage charges, no fast-path bypass.
Encryption at rest & in transit
AES-256-GCM for integration credentials with per-org data keys wrapped by a service-level master. TLS 1.3 on every endpoint.
- AES-256-GCM for integration credentials (Slack, Twilio, PagerDuty, DB)
- Per-org data-encryption keys wrapped by a master key
- TLS 1.3 on every public endpoint
- Internal service-to-service over Redis is encrypted at the transport layer
- Customer-managed encryption keys (BYOK / KMS)Roadmap
Per-tenant isolation
Tenant ID is on the JWT, applied to every query as a row-level filter. Postgres is the source of truth — Redis only carries transport and locks.
- Tenant ID claim on every JWT
- Every query takes organization_id as a row-level filter
- No cross-tenant joins permitted by the schema layer
- Postgres is the source of truth; Redis is ephemeral
- All Redis keys prefixed with the organisation scope where applicable
Plan entitlement enforcement
Capacity limits return 402 Payment Required with a structured upgrade payload — feature gates return 403 with the required plan tier. No silent failure.
- 50+ endpoints gated by plan capacity or feature flag
- 402 Payment Required on capacity limits with upgrade payload
- 403 Forbidden on feature flags with required-tier hint
- Per-endpoint entitlement check at the handler layer
- Front-end interceptor surfaces actionable upgrade toasts
Compliance programs
SOC 2 Type II, ISO 27001, GDPR, HIPAA and PCI DSS — programs you can map to your own audit obligations.
- SOC 2 Type II — annual report available under NDA
- ISO 27001 — certification in progress
- GDPR — DPA available; sub-processor list maintained
- HIPAA — BAA available on Pro+ plans
- PCI DSS — aligned controls; not a card processor
Self-hosted deployment
One Docker Compose file. Profile-based modes for bundled vs external Postgres + Redis. Same code as the hosted product.
- Single Docker Compose file with profile-based modes
- Bundled (pg + redis included) or external (BYO db + redis)
- Hybrid mode — bundled Postgres, external Redis (or vice versa)
- Same binaries as the hosted product
- Migrations applied via dockerised migrate runner
- Tenant-isolated VPC / private network agent deploymentRoadmap
Data residency & support
Today: hosted in primary region. Roadmap: per-region data residency, dedicated TAM, 24/7 critical-severity support.
- Per-region data residency (US / EU / APAC)Roadmap
- Dedicated TAM & 24/7 critical-severity supportRoadmap
- Terraform provider for configuration-as-codeRoadmap
- GraphQL API (alongside REST)Roadmap
- Security email — [email protected]
- Vulnerability disclosure policy in the Trust Center
How we stack up on security & platform
Only rows relevant to this capability. See the full comparison →
| Feature | AlertifyPro | Datadog | UptimeRobot | Pingdom |
|---|---|---|---|---|
| AES-256-GCM for integration credentials | ||||
| Self-hosted deployment | ||||
| SOC 2 Type II | ||||
| HIPAA BAA available | ||||
| Plan entitlement enforcement (50+ endpoints) | ||||
| Customer-managed encryption keys | Roadmap |
Frequently asked
Continue exploring
Teams & Access
Multi-org, RBAC, SSO (SAML + OIDC), SCIM, TOTP MFA, social login and per-tenant data scoping carried on every query.
Read moreAnalytics & Reporting
SLA targets, MTTA / MTTR, per-service uptime, scheduled digests, audit log — everything you need to prove reliability.
Read moreIntegrations
Nine integration types with encrypted credentials, HMAC-signed webhooks, delivery inspection and per-integration health.
Read moreReady to see security & platform on your stack?
Spin up your first monitor in under a minute. Free forever for the first 5 services.