Last updated: September 4, 2026
Table of Contents
Overview
StatusPage.me is a small, independent, privacy-focused company. We store your data on the same infrastructure we rely on ourselves - that alignment keeps us honest. This page describes the concrete technical measures we use. No marketing fluff, no badges we haven't earned.
Authentication & Access
| Password hashing | Argon2id - the current recommended algorithm (stronger than bcrypt/scrypt) |
| Breached password detection | Passwords are checked against the HaveIBeenPwned database using k-anonymity (your password never leaves our servers) |
| Two-factor authentication | TOTP (authenticator app) and WebAuthn / hardware security keys |
| Role-based access control | Team roles: Owner, Admin, Editor, Viewer - with per-status-page access scoping |
| Session management | Forced session invalidation on password change, secure & HttpOnly cookies in production |
| OAuth sign-in | Google and GitHub with state validation |
| Single sign-on | Dashboard OIDC on Business and Enterprise; Microsoft Entra ID, Google Workspace, and generic OIDC for viewers of eligible private status pages. Dashboard SAML is not currently available. |
| API keys | Scoped permissions, prefix-only storage (full key never stored), revocation support, last-used tracking |
| Security alerts | Email notifications on password changes, 2FA changes, and other account-sensitive actions |
Docs: Account Security & Password Protection, Temporary Support Access (TSA), Teams
Encryption
| In transit | TLS everywhere with HSTS enforced. Automatic HTTPS for all domains including customer custom domains via Let's Encrypt. |
| Sensitive data at rest | Selected fields are encrypted with AES-256-GCM: dashboard OIDC client secrets, OAuth access and refresh tokens, and Microsoft Graph integration secrets. This is not a blanket full-database or storage-volume encryption claim. |
| Passwords | Irreversibly hashed with Argon2id (never stored in plaintext or reversible form) |
| IP addresses | Hashed with SHA-256 before storage - raw IPs are not kept in the application database |
Infrastructure
| Architecture | 5 isolated service components (website, status pages, user dashboard, admin, scheduler) running as separate processes |
| Health monitoring | Per-component health checks with automatic routing - unhealthy components are removed from load balancing |
| Deployment safety | Automated pre-deploy backups, 2-minute post-deploy health monitoring, automatic rollback on failure detection |
| Security headers | HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection |
| Network protection | Network-level DDoS mitigation provided by our hosting provider, with edge TLS termination and request handling via Caddy |
| Dependency updates | Dependencies are tracked and kept current; we are expanding our automated scanning coverage |
Application Security
| SQL injection | All database queries use parameterized statements - no string concatenation of user input into SQL |
| XSS prevention | Server-side template auto-escaping, Content Security Policy headers |
| CSRF protection | Cryptographic CSRF tokens on all state-changing requests (forms and API calls) |
| SSRF protection | Server-side URL fetching blocks all private/internal IP ranges (RFC 1918, loopback, link-local, IPv6 ULA) |
| Rate limiting | Authentication endpoints, API calls, and public tools are rate-limited per IP |
| Request timeouts | Global 30-second timeout to prevent resource exhaustion |
Data Protection & Privacy
| Data deletion | Closed accounts are scheduled for removal from active systems under our retention policy; audit logs are purged after 90 days. See our Privacy Policy for full retention details. |
| Account closure | Self-service account deletion immediately flags the account as closed and queues it for data removal |
| Subscriber management | Double opt-in confirmation, one-click unsubscribe, bulk export and deletion |
| Audit logging | All administrative actions, authentication events, impersonation sessions, and data changes are logged with timestamps and actor context |
| Error log sanitization | Authorization and Cookie headers are automatically redacted from error logs |
Backups & Recovery
| Database backups | Automated daily backups with weekly and monthly rotation. Backups include full database state and global objects (roles, permissions). |
| Application backups | Timestamped binary backups on every deployment with 5-version retention |
| Recovery targets | RPO: 24 hours (daily backup interval). RTO: ~30 minutes (restore + restart). |
| Restore testing | Periodic restore-to-temporary-database verification to ensure backup integrity |
Uptime & SLA
We target 99.9% monthly uptime for the StatusPage.me platform. Our own status page is public - you can verify our track record anytime:
We use multi-region uptime monitoring with quorum-based alerting to minimize false positives. Automated deployment rollbacks help us recover from bad releases within minutes, not hours.
What we don't have (yet)
Transparency matters. Here's what we're working toward but haven't completed:
| SOC 2 certification | We follow SOC 2-aligned security practices but have not completed a formal audit. We're happy to answer specific questions from your compliance team. |
| Dashboard SAML | Not currently available. Dashboard OIDC is available on Business and Enterprise, and private-page identity providers are a separate capability. |
| Full database encryption at rest | Selected dashboard OIDC secrets, OAuth tokens, and Microsoft Graph integration secrets are encrypted with AES-256-GCM. We do not claim blanket application-level encryption of the database or storage volume. |
| Multi-region redundancy | Our monitoring agents run in multiple regions, but the core platform runs on dedicated infrastructure in a single region. Multi-region failover is planned. |
FAQ
Do you have SOC 2 certification?
Not yet. We follow SOC 2-aligned security practices, but we have not completed a formal audit. If your compliance team has a questionnaire, send it over and we’ll answer directly.
Is data encrypted at rest?
Selected dashboard OIDC client secrets, OAuth access and refresh tokens, and Microsoft Graph integration secrets are encrypted using AES-256-GCM. Passwords are irreversibly hashed with Argon2id. We do not claim blanket application-level encryption of the full database or storage volume.
Is traffic encrypted in transit?
Yes. TLS is enforced everywhere with HSTS, including for custom domains via Let's Encrypt.
Do you support SSO?
Yes, but dashboard SSO and private-status-page access are separate features. Dashboard OIDC SSO is included on Business and Enterprise. Eligible private status pages support Microsoft Entra ID, Google Workspace, and generic OIDC for viewers. Dashboard SAML is not currently available.
How do backups and recovery work?
We run automated daily database backups with weekly/monthly rotation, plus timestamped binary backups on every deployment. Our documented recovery targets are roughly RPO 24 hours and RTO about 30 minutes, with a documented restore procedure.
How do you protect against common web attacks?
We use CSRF protection, SSRF protections blocking private network ranges, parameterized SQL queries, server-side template escaping plus CSP headers, and rate limiting on sensitive endpoints.
How can I report a vulnerability?
Email security@statuspage.me with details and repro steps. We take reports seriously and will respond as quickly as we can.
Where can I view your uptime and incidents?
Our status page is public at status.statuspage.me.
Report a vulnerability
If you discover a security vulnerability, please report it responsibly. We take every report seriously and will respond as quickly as we can.