Your monitoring data tells a lot about your infrastructure, so we treat it carefully. This page describes how Alertly protects it.
The agent
- Open source. The Alertly agent is a single Go binary, and you can read every line of its code.
- Read-only. It only reads system metrics. It never runs commands sent from our side, opens no ports, and does not read your files, databases or application logs.
- Outbound only. The agent connects out to Alertly over HTTPS. You don't need to open any firewall ports.
- Per-server tokens. Each server has its own token. We store only a hash of it, and you can revoke or rotate it at any time.
- Verified updates. Automatic updates are checked against a published checksum before they are installed, and you can turn them off.
Your account
- Passwords are stored with a strong one-way hash, never in plain text.
- Two-factor authentication with an authenticator app is available for every account, with recovery codes.
- You can see the devices signed in to your account and sign them out.
- Teams are strictly separated. Roles (Owner, Admin, Member, Viewer) control who can change what.
- API tokens can be limited to read-only access and revoked at any time.
Data protection
- All traffic to Alertly uses HTTPS.
- Secrets such as chat webhook URLs, bot tokens and webhook signing secrets are encrypted at rest.
- Outgoing webhooks are signed, so you can verify they came from us, and they can't be pointed at private or internal networks.
- Uptime checks are blocked from reaching private and internal addresses.
- Error reports about our own software never include your form input, and email addresses in them are masked.
- Our dependencies are checked for known vulnerabilities on every change.
Payments
Payments are handled by Paddle, our Merchant of Record, which is PCI DSS compliant. Card details never touch our servers.
AI features
AI features are optional and can be switched off for a whole team. When used, only the monitoring data needed for the answer is sent to the AI provider, never passwords, tokens or payment details. See our Privacy Policy.
Reporting a vulnerability
If you think you've found a security issue, please email [email protected] with the details and steps to reproduce it. Please give us a reasonable time to fix it before telling anyone else, and don't access or change other customers' data while testing. We'll reply quickly, keep you updated, and credit you if you'd like.