Security

Where your data lives

Application servers and the database run in Amazon Web Services in the United States. The database is not shared between customers; every record carries the workspace it belongs to, and every query is scoped to the workspace of the signed-in account.

All traffic to it-watch.com is served over TLS with HSTS. The site sends a strict Content-Security-Policy, and browser sessions use HttpOnly, Secure, SameSite cookies.

How accounts are protected

Passwords are hashed with Argon2 — the algorithm, not a general-purpose hash — and we never store the password itself. There is a minimum length, a maximum length, and a check against lists of commonly used passwords.

Sign-in links and password-reset links work exactly once and expire. Resetting your password signs out every other session immediately, and you can sign out everywhere from Settings at any time.

Sign-in and password-reset requests are rate limited per address, so nobody can use our sending domain to flood an inbox.

You can sign in with Google using OIDC with PKCE, state and nonce verification.

What we never hold

We do not have credentials for the sites you monitor, and we never ask for them. IT Watch makes the same unauthenticated requests any visitor could: a TLS handshake, an HTTP GET, a DNS query, a public registration lookup.

That is a deliberate design constraint, and it is the reason a compromise of IT Watch could not be used to log in to your clients’ sites.

Card details go directly to Stripe. We store a customer reference, never a card number.

How the checking engine is constrained

The engine resolves every target before connecting and refuses loopback, private, link-local, carrier-grade NAT, reserved and multicast addresses — including on every redirect hop, not just the first request. Only http and https on ports 80 and 443 are allowed.

This stops the monitoring engine being used as a proxy into networks it has no business reaching, including our own.

Reporting a vulnerability

Email security@it-watch.com with enough detail to reproduce the issue. We will acknowledge within three business days and keep you updated until it is resolved.

Please give us a reasonable window to fix an issue before publishing it, and do not access or modify data belonging to anyone else while investigating. We will not pursue legal action against good-faith research that follows those two conditions.

We are a small team and do not run a paid bounty programme, but we will credit you if you would like us to.