Security: what is true today
This page lists only things that exist in the product and the infrastructure. The second half lists what we do not have. If a claim is not here, assume it is not true.
Built into the product
HTTPS everywhere
The app answers over HTTPS and sends an HSTS header. This marketing site is static and sets no cookies.
Signed webhooks
Webhook alerts carry X-Tenium-Signature: t=<unix time>,v1=<hex>, an HMAC-SHA256 of the timestamp and the raw body made with your secret. Verify it and reject old timestamps, see the webhook docs.
Published checker IPs
Checks come from the addresses on the checker IP page, also available as JSON, so you can allow them in a firewall or WAF. Requests identify themselves as Tenium-Monitor/1.0.
Sign-in protection
Passwords are stored as bcrypt hashes. Five failed sign-ins lock the account for 15 minutes and every further lock doubles the wait. Error messages do not reveal whether an account exists.
Request forgery checks
State-changing requests that carry a foreign Origin are refused. The exceptions are signed machine endpoints such as payment callbacks.
Security headers
Responses carry HSTS, X-Content-Type-Options, frame denial, a strict referrer policy and a locked-down permissions policy. A full Content-Security-Policy runs in report-only mode while we watch for violations. It is not enforced yet.
How our own staff are held back
The admin console can see accounts, refund money and open a customer view. It is locked down in layers that each work on their own.
Two-factor sign-in is mandatory
Every administrator needs a TOTP code (RFC 6238). The secret is stored AES-256-GCM encrypted, a used code cannot be replayed, and recovery codes are stored only as hashes.
Fresh proof for risky actions
Refunds, plan changes, adding administrators and write access in a customer view need a fresh password and code from the last 10 minutes.
Read-only customer view
Looking at your account as support is read-only by default, ends after 30 minutes, shows a permanent red banner and is written to the audit log.
Append-only audit log
No page or action in the application updates or deletes audit entries.
What we do not have
SOC 2 and ISO 27001
We hold no SOC 2 report and no ISO 27001 certificate.
Two-factor sign-in for customers
It exists for our staff only. Owners will be able to require it for members later, see the roadmap.
Single sign-on
SAML and OIDC are not built. Customers sign in with e-mail and password, or Google and GitHub.
Independent penetration test
We have no external penetration test report to show.
Your data
- Account data is stored on servers in the EU. Checks also run from regions outside it, and only the target URL and the result travel through those regions. Details are in the privacy policy, which is still a draft.
- Server logs with IP address and user agent are kept 30 days. Check history is kept 90 to 730 days depending on the plan.
- We store check results, not page content: a response excerpt is kept only when a check fails.
- We do not sell data or use it for advertising. The app sets one session cookie so you stay signed in.
Report a vulnerability
Write to the security address on the contact page and describe what you found and how to reproduce it. We usually answer within one working day. Please give us a reasonable time to fix the problem before you publish it.
Security questions
Is Tenium SOC 2 certified?
No. We hold no SOC 2 report and no ISO 27001 certificate. This page lists what is built instead.
How do I verify a webhook signature?
Read the X-Tenium-Signature header, split it into t and v1, compute an HMAC-SHA256 of the string t, a dot and the raw body with your secret, and compare it with v1. Reject requests whose timestamp is more than a few minutes old. The webhook docs have a Node example.
Which IP addresses do checks come from?
The addresses listed on the checker IP page, per region, also as a JSON feed. Allow them in your firewall or WAF.
Can I turn on two-factor authentication for my account?
Not yet. Two-factor sign-in is mandatory for our administrators, but customer accounts do not have it. It is planned.
Where is my data stored?
Account data is stored on servers in the EU. Checks run from several regions, including outside the EU, and only the target URL and the result pass through them.
Start monitoring in two minutes
30 monitors free, forever. No credit card. Moving from UptimeRobot? Import your monitors in one click with a read-only API key.