Security
Honest disclosure of how the service is built, what we control, and what we don't. No SOC 2 logo wall, no “bank-grade” marketing — just the actual posture.
Last reviewed: 9 May 2026 · This page is updated whenever the posture changes; the date above is the source of truth.
Domain ownership verification
Continuous monitoring requires proof you own the domain. Free one-shot checks don't.
Pointing a 5-minute-interval probe at someone else's site is — at best — surveillance, and at worst a reflective load-tool we'd be footing the bandwidth for. Before we activate continuous monitoring on the paid tier, we require proof that you own the domain. Three methods are accepted; pick the one that fits your hosting setup.
- DNS TXT record at
_web-down-verify.<your-domain>— strongest signal, recommended for anyone with DNS panel access (Cloudflare, Route53, registrar panel). - HTTPS file at
/.well-known/web-down-verification/<token>.txt— for users who deploy code or have file-system access (Vercel, Netlify, Hostinger, AWS, your own VPS). - HTML meta tag in
<head>on your homepage — for no-code users (Webflow, Framer, Wix, Squarespace, WordPress.com).
Verified domains stay verified across monitor lifecycle — adding a second monitor under the same domain skips the flow. Weekly background re-checks confirm the verification record is still in place; if it's removed, monitors auto-pause after a 28-day grace period (with a 21-day warning email). Every verification attempt — success or failure — is logged for audit. Rate-limited at 10 attempts per domain per hour.
The free homepage one-shot check (web-down.com/check/) is unaffected — single fetch, IP-prefix rate-limited, doesn't activate continuous polling. Verification only applies to paid continuous monitors. Public infrastructure (github.com, vercel.com, openai.com, …) is excluded entirely from paid monitoring; those live on the free SEO surface.
See the full domain verification guide for the per-method instructions.
Authentication
Passwordless only. No password reset flows because there are no passwords.
- Magic link via email — links expire in 10 minutes and are single-use. Sent from
noreply@web-down.comwith SPF, DKIM, and DMARC aligned on the sending domain. - GitHub OAuth and Google OAuth — minimum scopes (
read:user,user:emailfor GitHub;openid profile emailfor Google). - Account linking— magic link and OAuth on the same email auto-link to one account, so you can't accidentally end up with two duplicate accounts.
- Sessions— managed by Better Auth, stored as HTTP-only Secure SameSite=Lax cookies. No client-side token storage, so XSS can't steal a session.
- No password reuse risk— because we don't accept passwords. If your email or OAuth account is compromised, that's a problem upstream of us; we don't store credentials that could be re-played anywhere else.
Data handling
The minimum data possible, kept in Europe, deleted on a fixed schedule.
- No IP addresses logged. For free-tier rate limiting we salt-and-hash an IP-prefix with the current hour; the hash is one-way and discarded after 60 minutes. Nothing in our database can be reversed to identify a free-tier visitor.
- No tracker pixels. Our own self-hosted analytics (simple analytics) is the only analytics, opt-in via the GDPR cookie consent. No Google Analytics, no Facebook Pixel, no Hotjar, no LinkedIn Insight tag. Ever.
- Data location. Our database is self-hosted PostgreSQL on a Hostinger VPS in Belgium — your data lives on our own server in Europe and never leaves it. Polar.sh holds payment data (PCI scope, EU regulated). The Next.js app and monitoring workers run on the same Belgian VPS.
- Encryption in transit. TLS 1.2+ on every public hostname (web-down.com, admin.web-down.com), Let's Encrypt certs renewed automatically via Traefik. HSTS preloaded.
- Retention.Per-check history retained 30 days. Daily aggregate metrics retained indefinitely (small per-row footprint, useful for trend analysis). Account deletion fully purges monitors, results, incidents, AI reports, anomalies, and subscriptions — runs synchronously when you click “Delete account” in settings.
- No third-party data sale. We don't share, sell, or rent data to anyone. Subprocessors listed below are operationally necessary and named explicitly.
Subprocessors
Every third party we route data through, and what they touch.
| Provider | Purpose | Data exposed |
|---|---|---|
| Polar.sh | Subscription billing (merchant of record) | Account email, billing address, country, payment method (PCI scope) |
| Anthropic (Claude API) | AI anomaly explanations + weekly digest (Pro tier) | Anomaly metadata + monitor URL — no email or PII |
| Hostinger | VPS hosting (Next.js + monitoring worker) | All app traffic and runtime state |
Adding a subprocessor materially increases our data exposure, so we notify in the dashboard and via email at least 14 days before activation when one is added. You can cancel before the change takes effect.
Infrastructure & operations
What we run, who can touch it, what happens when something goes wrong.
- Reverse proxy. Traefik terminates TLS and routes to two Next.js + worker containers (web-down-app, web-down-monitoring-worker), no direct VPS port exposure besides 80/443.
- Admin surface isolation.
admin.web-down.comis a separate subdomain. Middleware redirects every non-admin path on that host back to the main site, marks every admin responseX-Robots-Tag: noindex, nofollow, and the admin pages themselves enforce a three-layer auth gate (env var allowlist + Better Auth session check + database query-level re-check). - Single-operator access. One person (flndrn) holds production credentials. No shared admin accounts, no contractor logins, no support staff with database access. Reduces blast radius of any one credential compromise.
- Backups. The PostgreSQL database is self-hosted on the VPS and covered by daily Hostinger VPS snapshots. Restores are tested by spinning up a copy quarterly (next scheduled: Q3 2026).
- Dependency hygiene.npm audit + Renovate-style review on a 14-day cadence. We don't pin
@lateston direct deps; lockfile is committed and reviewed on each change.
EU regulatory posture
GDPR, EU VAT directive, KYC for paid customers.
- GDPR. Operated under Belgian/EU jurisdiction. Lawful bases: contract (paid accounts), consent (analytics, marketing), legitimate interest (free-tier abuse prevention via rate-limited IP hashes). Data subject rights (access, rectification, erasure, portability, restriction) are honored — see Privacy Policy for the formal flow.
- EU VAT directive.Polar.sh handles the billing side as our merchant of record — VAT calculated and remitted per the customer's billing country, with a valid invoice issued for every charge.
- KYC for paid customers. Billing address, date of birth, and country of birth are collected on settings — required for EU customer-identification rules. Stored in the same database as account data, accessed only by the operator, never used for marketing.
- No US-style data export. Customer support, account data, and the monitoring database all stay in the EU — the database is self-hosted PostgreSQL on our Belgian VPS, not a US-hosted cloud service.
Vulnerability disclosure
If you've found a security issue, we want to hear about it.
- In scope:
web-down.com,admin.web-down.com, the application backend, monitor worker, public APIs. - Out of scope: third-party services we use (report directly to them), denial-of-service attacks, social engineering of the operator, physical attacks on data-center hardware.
- How to report: use the contact form with subject tag
#bugand “security” in the message. We'll acknowledge within two business days, work with you on a fix, and credit you in the release notes if you'd like. - Bounty program:we don't run a paid bounty program at this stage of the business — we're a single operator without budget for it. We'll send a sincere thank-you, public credit, and a free year of Pro for material findings. As revenue grows we'll formalize this with a real bounty schedule.
- Safe-harbour.Good-faith security research that respects scope and doesn't access user data beyond what's needed to demonstrate the issue will not be pursued legally. If a finding requires touching user data, stop and ask first.
What's deliberately not here yet
We don't hold SOC 2 Type II, ISO 27001, or HIPAA certifications. The cost-to-value of those for a single-operator SaaS at our stage doesn't justify the audit fees, and we'd rather say so honestly than pay a consultancy to bolt on the appearance of compliance. If you operate in a regulated industry that requires those certifications, you should buy from someone who has them — and we won't be offended.
Questions or concerns about anything on this page? Get in touch.