Instatus Startseite

Security Whitepaper

Last updated

Keeping customer data safe is a huge responsibility and a top priority for Instatus. We run our own company on the same infrastructure our customers use, so we're motivated by self-preservation as well. This whitepaper answers the questions security and procurement teams ask most often. For anything it doesn't cover, email security@instatus.com.

Infrastructure

  • Hosting. Our primary infrastructure runs on Amazon Web Services in the United States (Ohio, us-east-2, and North Virginia, us-east-1). Status pages, the dashboard and our websites are served by Vercel's global edge network, and our API sits behind Cloudflare for DDoS protection. Monitoring checks run from servers in several regions so we can test your services from where your users are.
  • Database. The primary PostgreSQL database runs on Amazon RDS across multiple availability zones with automatic failover and deletion protection.
  • Subprocessors. Every provider that processes customer data is listed, with its purpose and location, on our subprocessors page.

Encryption

  • In transit. All traffic between you and Instatus uses HTTPS (TLS), including the dashboard, API, status pages and webhooks we send to HTTPS endpoints.
  • At rest. The primary database and its backups are encrypted at rest with AES-256 using AWS-managed keys.
  • Credentials and secrets. Passwords are salted and hashed with bcrypt. Instatus API keys and the SMTP passwords you give us for your own email server are encrypted at the application level. Other provider credentials you add, such as SMS API tokens, are protected by database encryption at rest and access controls. Production secrets are kept in AWS Secrets Manager and CI secrets stores, never in source code.

Access control

  • Customer accounts. Teams can require multi-factor authentication and SAML single sign-on, provision and deprovision users with SCIM, and give each member full, editor, member or read-only access. Private status pages can require a password, Google sign-in or SAML single sign-on.
  • Instatus staff. Access to production systems and customer data is limited to people who need it for their role, uses individual accounts protected by multi-factor authentication, and is removed promptly when someone changes role or leaves. Staff only access customer accounts to provide support you've asked for, investigate abuse or fix problems.
  • Personnel. Everyone at Instatus signs confidentiality obligations before getting access to code or data, and is trained on security and privacy practices.

Application security

  • Every code change is reviewed before it ships, including automated review.
  • Dependencies are updated regularly and monitored for known vulnerabilities.
  • The Service applies rate limiting, bot protection (hCaptcha) on public forms, secure HTTP headers, and checks that block abusive status page content.
  • We follow common secure development guidance such as the OWASP Top 10.

Availability and backups

  • The primary database is backed up automatically every day, with backups stored encrypted in a separate location. We test restores.
  • Status pages are cached at the edge, so they keep serving during traffic spikes.
  • We publish our own uptime and incidents at instat.us, and commit to uptime in our SLA.

Data handling

  • Location. Customer data is stored primarily in the United States. See international transfers.
  • Deletion. Content you delete is removed from our active systems within 30 days. When you cancel, all your data is deleted from active systems within 30 days and from backups within 60 days, and can't be recovered after that.
  • AI. We never use customer data to train AI models, and our AI providers are contractually prohibited from doing so.
  • Law enforcement. We don't hand over customer data without a court order or other legally binding process, and we notify affected customers unless the law prohibits it.

Monitoring and incident response

  • We log access to production systems and security-relevant events, monitor for anomalous activity and abuse, and alert our team when something looks wrong.
  • We have a documented incident response process. If a security incident affects your personal data, we notify you without undue delay and within 48 hours of becoming aware of it, as committed in our DPA, and keep you updated as we investigate.

Compliance

  • Our Data Processing Addendum covers the GDPR, UK GDPR, Swiss FADP, CCPA and other privacy laws, and includes the EU Standard Contractual Clauses.
  • Payments are processed by Paddle, a PCI DSS Level 1 certified provider; card data never reaches our servers.
  • Instatus does not currently hold a SOC 2 or ISO 27001 certification. Our main infrastructure providers, such as AWS, Vercel and Cloudflare, do, and we're happy to complete your security questionnaire.

Vulnerability disclosure

We welcome reports from security researchers. See our security response page for how to report a vulnerability and what happens next.