Sessions without plaintext tokens
Uptimo stores only a SHA-256 hash of the session token.
Security
Collect less data. Set clear access boundaries.
Monitoring needs deep visibility, but it does not need every piece of available information. Uptimo separates required measurements from data that deliberately stays out.
See how Uptimo protects accounts, agent connections, and sensitive monitoring data.
Account access and roles
Organisations have their own memberships. Owners, admins, members, and viewers receive different permissions. Viewers can read but cannot make changes.
Optional TOTP protects sign-in with a second factor. Setup creates recovery codes so a lost device does not automatically lock the account.
Roles with clear permissions
Owner, admin, member, and viewer roles control permissions within an organisation.
TOTP when needed
Two-factor authentication can be enabled per account and backed by recovery codes.
An agent that opens no door inward
The agent works outbound. It accepts no inbound connection and opens no port on the monitored host.
Process command lines are deliberately not collected. Diagnosis still has process name, user, status, and measurements without transferring arguments or potential secrets.
Sensitive data sources stay opt-in
Docker monitoring needs access to the Docker socket. That access remains highly privileged even with a read-only mount, so it must be enabled explicitly.
The optional geo and provider lookup for server IP addresses is off by default. Private address ranges are never sent to that third party.
Public status pages need their own boundary
Status pages are publicly reachable. Their presentation separates measured status, unknown periods, and updates from your team.
Uploaded SVG files are not accepted as logos because active content can create a stored-XSS risk.
FAQ
Security questions
Does Uptimo have SOC 2 or ISO 27001 certification?
No. Uptimo is not SOC 2 or ISO 27001 certified and has not undergone an external security audit.
Does the agent collect full process command lines?
No. Command lines are deliberately excluded so arguments, tokens, and other potential secrets do not enter the platform through this measurement.
Is two-factor authentication available?
Yes. An account can enable TOTP. Setup creates recovery codes for cases where the second factor is lost.
Is a server IP sent to a geo service automatically?
No. Geo and provider lookup is disabled by default. Private address ranges are not sent even when the feature is enabled.
Is Docker monitoring enabled by default?
No. Socket access and container rules must be enabled deliberately. A read-only mount does not make the Docker socket an unprivileged data source.
Inspect what data the platform handles.
The platform page explains the agent, measurement paths, supported systems, and deliberate boundaries.