Security

• Two-factor sign-in with an authenticator app (TOTP), with backup codes. The TOTP secret is stored encrypted.
• New email accounts verify their address before creating monitors.
• Sign-in and the telemetry endpoint are rate limited; over the limit, the API answers 429 RATE_LIMITED.
• Sign-in, sign-up and password reset pages are protected by reCAPTCHA v3.

• API keys and MCP tokens are stored only as SHA-256 hashes and shown once, when you create them.
• Integration secrets, such as webhook signing secrets, are encrypted with AES-256-GCM.
• Outgoing webhooks are signed with HMAC-SHA256 in the X-Alert-Signature header, so your endpoint can check they came from us.

• Security headers are set on every API response (helmet).
• Every API error carries a request ID, so a problem you report can be traced without sharing your data.

• Contact and early-access forms keep a salted hash of your IP address, never the address itself.
• Error reports have query strings, cookies, authorisation headers and request bodies removed, and there is no session replay.
• Monitoring history is deleted once it is older than your plan's retention period (7 days on Free, 90 days on Starter, 365 days on Enterprise).
• Before an AI diagnosis, the context is cut down to the monitor's host name, recent result codes and the issue timeline. API keys, headers, request bodies and alert recipients are never sent.
• Payments are taken on pages hosted by Stripe; card details never reach FastMonitor.

We welcome reports from security researchers acting in good faith. Until we open a dedicated security mailbox, send your report through the contact form with the category “Other” and “Security” in the subject.

• Tell us what you found and how to reproduce it.
• Do not access, change or delete other customers' data; use your own account for testing.
• Do not run denial-of-service or load tests, and give us reasonable time to fix the issue before you disclose it.

We will not take action against good-faith research that follows these rules. Our /.well-known/security.txt file has the same contact.

The Privacy Policy and the sub-processor list explain what data we hold and who processes it.