What we do

Passwords and sessions	Passwords are stored hashed with bcrypt. Sessions are signed cookies, renewed on login, and closing the session invalidates them.
Two-factor authentication	Available for every account from Account → Security.
API tokens	Only the SHA-256 hash of the token is stored. If ours leaked, nobody could rebuild your token from it. You can change it at any time from Account → API.
Separated APIs	The integration API for our largest client lives on its own hostname with an IP allowlist; the public API lives on another. One cannot reach the other.
Outbound request filter	Every request our checker or the Kit makes is checked before it leaves, and again on each redirect: a monitor can never be pointed at a private network, at localhost or at cloud metadata addresses.
Security headers	Content Security Policy, HSTS, X-Content-Type-Options, Referrer-Policy and Permissions-Policy on every response.
Verified domains for intrusive checks	Looking for exposed files or open ports only runs on domains whose owner proved control (a DNS TXT record or a file on the site), with a plan that includes it, and after switching it on by hand. Every run and every refusal is written to an audit log.
Automatic backups	The database is dumped every night, kept for seven days, readable only by the server administrator.
Least privilege	The application runs as an unprivileged user. Administrative pages require the administrator role and a verified email.

What we do not store

• We never store the body of the pages we check: only status code, response time and the metadata shown in the technical sheet.
• We never store credentials of the sites we monitor beyond the optional HTTP authentication you configure, which is encrypted at rest.
• When an intrusive check finds an exposed file we record the path, the status code and the size. Never the content.
• Anonymous X-ray reports expire after 30 days and are deleted.
• We do not sell, rent or share your data with advertisers. There are no third-party trackers on the panel.

Reporting a vulnerability

If you found a flaw, write to us. We answer within 72 hours, we will not take legal action against research done in good faith, and we will credit you if you want to be credited.

• Contact form: https://monitoraweb.com/contact
• Machine-readable policy: /.well-known/security.txt

Please do not run automated scans against our servers, do not access data that is not yours, and give us a reasonable window before publishing. Testing against your own account is welcome.

Where the data lives

Our servers are in the United States, with checks planned from more regions. Domain and WHOIS data comes from public registries. Email is delivered by our mail provider. The subprocessor list is part of the data processing agreement.

Data processing agreement

Security changelog

Date	What changed
2026-09-12	Outbound request filter (SSRF) on checks and on the Kit, including redirects. TLS verification on webhooks. Stronger password rules.
2026-09-12	Integration API moved to its own hostname with an IP allowlist, separate from the public API.
2026-09-13	API tokens stored hashed. Authorization policies on every API resource.
2026-09-14	Content Security Policy enforced. Verified domains and audit log for intrusive checks.
2026-09-14	Daily database backup added, with seven days of retention.