Security: how OKStatus protects your data in the EU.
Where your data lives, how it is protected, who can reach it, and how to tell us about a vulnerability. Plain facts, kept current — the same ones we give enterprise security reviews.
Contact: mailto:contact@clearcloud.fr Preferred-Languages: fr, en Canonical: https://okstatus.eu/.well-known/security.txt Policy: https://okstatus.eu/security#disclosure
Hosting & data location
The platform and database run on Scaleway in Paris. Backups, continuous with point-in-time recovery, are stored on OVHcloud in Gravelines. Probes run your checks: they receive your target's address and, if the monitor has any, its credentials (basic auth, token), never your account data; results come back to the EU. Each probe authenticates with its own credential, bound to its region: it only receives that region's checks. Every sub-processor, probes included, is listed with its exact location on a dated page with a change feed.
Encryption
TLS 1.2+ everywhere (HSTS on every public host). Customer secrets — monitor credentials, alert-channel tokens, API keys — are encrypted at rest with AES-256-GCM under a key that is not stored with the data. Backups are encrypted.
Access & identity
Sign-in runs on Keycloak: password, social sign-in, or your own identity provider (SAML/OIDC, Enterprise). TOTP two-factor for every account, mandatory for our staff console. Roles (owner, admin, member, viewer) enforced server-side.
Audit & traceability
Every create, update and delete on your organization is journaled (who, what, when, from where) and available to Enterprise customers in the dashboard and as CSV export. Staff actions are journaled separately.
Backups & continuity
Continuous PostgreSQL backups with point-in-time recovery, restore procedure tested and documented, public status page hosted off-infrastructure so it stays up when we are not.
Software supply chain
Container images are rebuilt from pinned bases, scanned for CRITICAL vulnerabilities in CI before they can be pushed, and re-scanned in the cluster daily. Dependencies are audited on every build.
Responsible disclosure
Found something? Write to the address below with the steps to reproduce. We acknowledge within 2 business days, keep you informed, and credit you if you wish. Good-faith research that avoids data destruction, privacy violations and service disruption will not lead to legal action.
In scope: okstatus.eu, api.okstatus.eu, docs.okstatus.eu, the public status pages and the Rust agents. Out of scope: denial of service, social engineering, third-party services we do not operate.
Machine-readable contact: /.well-known/security.txt
Documents
Sub-processor list, DPA, SLA annex, privacy policy and the compliance page. The security pack (CAIQ-Lite and SIG-Lite questionnaires, security policies, incident-response plan) is sent on request, whatever your plan.