Security

Last updated: July 18, 2026

1. Reporting a vulnerability

If you find a security issue in CertWatch.io, email security@certwatch.io. We send an initial response within 48 hours and keep you informed while we work on a fix. Please give us a reasonable window to resolve the issue before disclosing it publicly.

2. Authentication and access control

Sign-in is handled by Clerk, our identity provider. CertWatch.io never sees or stores your password.

API keys are bound to a single organization and stored as salted PBKDF2-SHA-256 hashes with 100,000 iterations. We keep a short prefix for display; the full key is shown once at creation and cannot be recovered afterward.

Access within an organization uses three roles: Admin, User, and Reader. Readers can view but not change anything; Users manage monitors; Admins control the organization itself.

Each organization’s data is isolated. Every query is scoped to the requesting organization, and organizations are assigned to separate database shards.

Platform administration endpoints deny access by default. They require an explicit IP allowlist in addition to authentication.

3. Application security

All traffic uses HTTPS; plain HTTP requests are redirected. API responses include security headers such as X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.

Database queries are parameterized. Request bodies are limited in size and sanitized before processing. Cross-origin browser requests are restricted to an explicit list of allowed origins, and API endpoints are rate limited.

4. Webhook signatures

Outgoing webhooks are signed with HMAC-SHA256. The signature covers the request timestamp joined with the raw body, so you can verify that a payload came from CertWatch.io and reject replayed or altered requests. The signature and timestamp arrive in the X-CertWatch-Signature and X-CertWatch-Timestamp headers.

5. Payment data

Stripe processes all payments. Card numbers never reach CertWatch.io systems; we store only Stripe’s customer and subscription identifiers.

6. Data retention

Security audit logs are deleted after 90 days. Alert and notification history is deleted 60 days after an alert is resolved. The Privacy Policy lists retention periods for all data we hold.

7. No tracking

The CertWatch.io website and dashboard load no analytics or tracking scripts. The only cookies are the session cookies set by Clerk for signing in.

8. Questions

For anything not covered here, email security@certwatch.io.