Security Overview
Last updated
Your data is encrypted
Everything sent between you and Instatus is encrypted with HTTPS (TLS). Our primary database and its backups are encrypted at rest with AES-256. Passwords are salted and hashed with bcrypt, and secrets such as API keys and SMTP passwords are encrypted again at the application level.
Built to stay up
Our primary database runs on Amazon Web Services across multiple availability zones with automatic failover, and is backed up every day to a separate, encrypted location. Status pages are served from a global edge network, so they stay fast during the traffic spike that comes with an incident. We publish our own uptime at instat.us.
Control who gets in
Protect your team with multi-factor authentication, SAML single sign-on, SCIM provisioning and role-based permissions. Private status pages can require a password, Google sign-in or SAML single sign-on.
Kept up to date
Code changes are reviewed before release, dependencies are updated regularly, and the Service applies rate limiting, bot protection and secure HTTP headers. Access to production systems is limited to the people who need it.
Your billing information is protected
Payments are processed by Paddle, a PCI DSS Level 1 certified payment provider. Card details go straight to Paddle and never touch our servers.
Your privacy
We never sell your data, never use it to train AI models, and only access your account to help you or keep the Service safe. Read our Privacy Policy, Data Processing Addendum and subprocessors.
Want more detail?
Our security whitepaper covers our practices in depth. For a security questionnaire, email security@instatus.com.
Found a problem?
If you've noticed abuse, a vulnerability or a security incident affecting your account, please follow our security response process.