Security

Overview

Uptiqr is a small, independently-run product. We don't have a SOC 2 or ISO 27001 certification, and we won't claim one we don't have. What follows is an honest account of the concrete security practices actually in place today, and the subprocessors your data passes through. See our Privacy Policy for full detail on what we collect and why.

Practices in place today

• Encryption in transit: every connection to Uptiqr, dashboard and public status pages alike, is served over TLS/HTTPS.
• Encryption at rest: our database is encrypted at rest via Supabase. Slack bot tokens are additionally encrypted at the application layer with AES-256-GCM before they're stored — a raw plaintext token never lands in the database.
• No plaintext credentials: API keys are stored as a SHA-256 hash, never the raw value — the raw key is shown to you exactly once, at creation. Passwords are handled entirely by Supabase Auth; we never see or store them ourselves.
• Row-level security: every table that holds customer data (monitors, incidents, status pages, alert settings) is scoped by Supabase row-level security policies, so a query can only ever reach the data it's authorized for, enforced at the database layer, not just in application code.
• Nonce-based Content Security Policy: every page is served with a strict, per-request nonce-based CSP (script-src 'strict-dynamic'), which blocks unauthorized inline scripts from executing even if one were ever injected.
• Signed webhook verification: inbound requests from Slack (button clicks, interactions) are verified against Slack's HMAC signature with a 5-minute replay window — a missing, forged, or stale-timestamp signature is rejected before anything is processed.
• Separate, revocable API auth: the public v1 API uses its own bearer-token mechanism, entirely separate from the session cookie that authenticates your dashboard. Keys can be revoked at any time from Settings, and a revoked key is rejected immediately on the next request.
• Outbound request protections: webhook and monitor URLs you configure are validated against SSRF (server-side request forgery) before Uptiqr makes any outbound request to them.

Subprocessors

We rely on the following third-party services to run Uptiqr. Each is described in more detail, with links to their own privacy policies, in §5 of our Privacy Policy.

• Supabase — database, authentication, and file storage
• Vercel — application hosting and edge infrastructure
• Upstash QStash — cron scheduling for ping checks and background jobs
• Resend — transactional email delivery (alerts, confirmations)
• Twilio — SMS and phone call alert delivery
• Stripe — payment processing; we never see or store card numbers
• ImprovMX — email forwarding for our support inbox
• check-host.net — multi-location uptime checks

Reporting a vulnerability

If you believe you've found a security issue in Uptiqr, please email support@uptiqr.com with details. We take reports seriously and will respond as quickly as we can. Please don't publicly disclose an issue before we've had a chance to address it.