Security and privacy

Alertly.Net is designed to see as little as possible of your servers, and to keep what it does see private to your team.

Protect your account

In Profile you can:

Turn on two-factor authentication with any authenticator app (1Password, Google Authenticator, Authy…). Save the recovery codes somewhere safe. Each one works once if you lose your phone.
See your browser sessions and sign out everywhere else with one click, for example after using a shared computer.
Change your password. Use a long, unique one from a password manager.

Owners: turn on two-factor authentication. Your account controls billing and every server in your teams.

The agent only reports measurements and names:

CPU (in total and per core), memory, swap, disk, inode, load and network figures.
Hostname, IPv4 and IPv6 address, timezone, operating system, kernel, processor architecture and uptime.
Network interface names and their addresses.
The state of services you watch, the names of failed systemd units, and (with --docker) every container's name, image, state and usage.
The names, users and usage of the busiest processes by CPU and by memory, and listening ports.
Whether a firewall is on, how many package updates are waiting, and figures from any databases or web servers you set up.
Counts and names from the authentication and kernel logs: failed SSH logins, who used sudo, new account names, who was added to an admin group, processes stopped for lack of memory, and the disks and processes involved in system errors. The log lines themselves and IP addresses stay on your server.

It never sends file contents, command lines, arguments, environment variables, log lines or anything from your databases.

It runs as a dedicated alertly user with no shell and no sudo rights.
systemd sandboxing makes the filesystem read-only to it, apart from its own /var/lib/alertly folder, with no way to gain new privileges.
systemd limits it to a quarter of a CPU core and 256 MB of memory.
It can read the authentication and kernel logs to count failed SSH logins, sudo use, new accounts, out-of-memory kills and system errors. Install with --no-logs to turn that off.
Package update checks are read-only. Nothing is installed.
Updates are checked against their SHA-256 checksums and only downloaded from the address in the agent's own configuration file. The daily updater runs as root so it can replace the binary. Install with --no-auto-update to update by hand.
Your Alertly.Net administrator can turn off process lists, ports, logs, updates, firewall, Docker and database data for every server.
It only makes outbound HTTPS requests. No ports are opened on your server.
Docker access is off unless you install with --docker.
Each server has its own token. We only store a hash of it, so a database leak wouldn't reveal it. Generate a new token any time from the server's Settings.

All traffic uses HTTPS.
Notification secrets (webhook URLs, bot tokens and signing secrets) and two-factor secrets are encrypted at rest.
Teams are fully isolated. Every request checks that you belong to the team that owns the data.
Uptime monitors and webhooks can only reach public addresses, so they can't be turned against private networks.
Status pages only show what you explicitly publish, under the names you choose.

Server metrics are kept for your plan's history period, then deleted automatically.
Team activity entries are kept for 90 days.
Deleting a server, monitor or heartbeat deletes its history. Deleting your account deletes the teams you own and everything in them.

Found a security issue? Please email us privately with the details rather than posting publicly. We'll reply quickly and credit you if you like.