Security

Security by design.

A monitoring service ends up holding a map of what matters in your infrastructure: which jobs exist, when they're supposed to run, and who to call the moment one goes quiet. That's worth protecting properly, not bolting security on as an afterthought. Here is what's actually built, plainly stated.

Your data is encrypted with your own key

Every account gets its own encryption key, generated the moment the account is created. Sensitive fields, check names, alert channel targets, the email address you sign in with, are encrypted at rest with AES-256 before they're stored. A stolen backup or a copy of the database reveals none of it.

When you delete your account, its encryption key is destroyed. Every check, channel and label that was encrypted under that key becomes permanently unreadable, even in old backups, a technique known as crypto-shred: not a "marked deleted" flag, an actual loss of the ability to read it back.

Pings that cannot be faked or replayed

A plain check-in URL is a bearer secret: anyone who sees it, in a log line, a leaked script, on the wire, can send a fake "I'm alive" and hide a real failure behind it. Mortemain offers optional signed check-ins per check: each ping is signed with a secret unique to that check, and every signed check-in is honoured exactly once. A captured request cannot be replayed later to keep a dead job looking healthy.

Each check can also require HTTPS-only check-ins, and Mortemain alerts you when a check receives a rejected ping, a bad or missing signature, a stale timestamp, so an attempt to interfere becomes visible instead of silent.

See the guide: Sign your check-ins with HMAC.

Your account

Two-factor authentication (TOTP) with one-time recovery codes for when you lose the device, passkeys (WebAuthn) so you can sign in without holding a password at all, and sign-in with GitHub, Google, LinkedIn or Microsoft if you'd rather not hold a Mortemain password in the first place. Sessions are listed and revocable, so a lost laptop or a stale browser tab doesn't stay signed in indefinitely.

Honest by construction

If Mortemain itself has a blind spot, its own outage, a delay that keeps it from actually knowing a check's state, it says so instead of guessing. An alert only ever goes out when there's a real signal behind it; when Mortemain can't vouch for a check, it stays quiet rather than inventing a status. See the FAQ for what happens during a Mortemain outage.

Where your data lives

Three datacentres in the EU, two in France and one in Germany, with automatic failover and no human in the loop. Your data never leaves the EU, and processing is carried out under the GDPR.

Reporting a vulnerability

Found a security issue? Our disclosure contact is published at /.well-known/security.txt, or reach us directly through the contact page. We reply to every genuine report.