Security

How StatusBird protects monitoring data

What we collect is small by design: which services you monitor, where to send alerts, and the results of our own checks. This page says how that data is protected, stated plainly so it can be pasted into a vendor questionnaire. Last reviewed September 22, 2026.

What we hold

• Your account email, a salted password hash (never the password), and optional alert contacts: phone number, Slack, Teams or Discord webhook URLs.
• Which of the 84 monitored services you follow, and the storefront URLs you asked us to check.
• Our own measurements: the status each vendor published, and the response of your storefront, every two minutes. These contain no order data, no customer data, and no payloads from your systems. We read public status pages and public URLs; nothing runs inside your infrastructure.
• Billing lives at Stripe or Shopify; we store their customer and subscription identifiers, never card details.

Encryption

• In transit: TLS 1.2 and 1.3 only on every endpoint (statusbird.io, index.statusbird.io, the API and MCP endpoints), with HSTS. Older protocols are refused. Connections from the application to its database are encrypted, including on the hosting provider's internal network.
• At rest: the database and its backups are encrypted with AES-256 by the hosting provider (Render, SOC 2 Type II). Files on the scan host are on encrypted disks (Google Cloud, default encryption with provider-managed keys).

Access

• One operator account holds administrative access; every administrative action is written to an append-only audit log with the actor, address and time.
• Two-factor authentication (TOTP) is available to every account and required for the operator account. Backup codes are stored hashed.
• Every record is scoped to the account that owns it. There is no cross-account query path in the application, and public pages publish only aggregates.
• You decide who on your side sees and changes what. Invite your people to your account as an admin, who can change alert settings, alert contacts, monitored services and store monitors, or a viewer, who can read the dashboard, incidents, history and reports and change nothing. Billing, the plan, account deletion, two-factor settings and the member list stay with the account owner. Invitations are single-use links tied to the invited address and expire after 14 days, and every invitation, acceptance, role change and removal is written to the audit log.
• Server-to-server calls between our own systems carry no shared password. Each request is signed with HMAC-SHA256 over its timestamp, a single-use nonce, the method, the path and a hash of the body, so the secret never travels on the wire and a captured request cannot be replayed: signatures expire in five minutes and a nonce is accepted once. The caller's source address must also be on an allowlist, the signing key rotates on a schedule with two keys valid during the changeover, and every call and refusal is audited.
• Logins are rate limited; failed attempts are logged.

Integrity of the record

Monitoring history is written once and never edited by the application. Every day at 00:20 UTC we compute a SHA-256 digest over every reading of the previous day, chained to the day before, and publish it at /api/public/v1/integrity.json. Anyone holding a copy of the raw data can recompute a day and compare; a deleted or altered reading changes every digest from that day forward. CRM deliveries and incident acknowledgements are in the same chain, so the record of which incident became which ticket, and who acknowledged it, is tamper evident too. Sealed reports carry their own hash and a verification page.

Availability and abuse

• Public endpoints and the free checks are rate limited per address. The scan host limits check requests at the web server.
• An independent watchdog alerts the operator if monitoring stops writing readings; the /health endpoint reports it too.

Retention and deletion

• Set your own retention window. Under Settings > Data retention, on every plan, choose to keep your data for 30, 90, 180 or 365 days, or keep it indefinitely. A nightly job removes anything past your window and the settings page shows how many records that is before you save.
• That window covers the data that is yours: the checks we run against your storefronts and the log of alerts we sent you. It does not cover our measurements of third-party services such as Stripe or Shopify. Those readings are our own record of what each vendor published, shared by everyone monitoring that vendor and used for the public reliability statistics, so no single account's window shortens them. They identify no customer.
• Delete your account from Settings at any time; your services, alert contacts, monitors and their readings are removed immediately. Aggregate public statistics contain nothing that identifies an account.
• Export first if you want a copy. Settings > Data retention offers a one-click JSON export of your profile, settings, monitored services, alert contacts, store monitors, store checks inside your window, and your alert history. It never contains your password or any access token.
• Free store check results are kept seven days. Audit log entries and daily digests are kept as a permanent record of the service itself.

Dependencies and vulnerability handling

Dependencies are pinned and audited against the Python advisory database; known-vulnerable versions are upgraded promptly. Report a vulnerability to security@statusbird.io; we acknowledge within two business days and do not pursue good-faith researchers.

Compliance

StatusBird LLC is not itself SOC 2 or ISO 27001 certified. Our hosting providers are (Render: SOC 2 Type II; Google Cloud: SOC 2, ISO 27001), and the controls above are documented so a customer's own review can proceed without a certification. Our written policy set (information security, access control, change management, incident response, business continuity, vendor management, data retention and risk register) and a control matrix mapping each SOC 2 Trust Services Criterion and ISO 27001 Annex A theme to the control that meets it and its evidence are available on request. If your procurement requires a signed questionnaire or a data processing agreement, email security@statusbird.io.