Start free

Security

Operated by [to be completed]. Effective [to be completed].

Draft — to be reviewed by counsel before launch. Statements about how the service handles data describe the current code. Legal terms are not final.

Reporting a vulnerability

If you think you have found a security problem in Blip24, email [to be completed]. Please include what you found, where, and the steps to reproduce it. We will acknowledge your report, keep you updated while we fix it, and credit you if you would like.

  • Test only against your own account. Do not access, change or delete other people's data; if you reach any by accident, stop and tell us.
  • No denial-of-service, spam, social engineering or physical attacks.
  • Give us reasonable time to fix the problem before telling anyone else.

We will not take legal action against research done in good faith within these rules. Machine-readable contact details are in /.well-known/security.txt.

How your data is protected

  • In transit. The site and API are served over HTTPS only, with HTTP Strict Transport Security.
  • Passwords are stored as bcrypt hashes. Password reset tokens are stored hashed and expire.
  • Two-factor authentication. Any user can require a code from an authenticator app (TOTP) at sign-in, and an organization owner can require it for every member; the secret is encrypted in the database and recovery codes are stored only as hashes.
  • Alert channel secrets. Webhook URLs, email targets, API keys and signing secrets for alert channels are encrypted in the database (AES-256-CBC) with a key kept outside it, and are never included in API responses — the dashboard shows a masked hint instead.
  • Invitation links are stored only as SHA-256 hashes, and expire.
  • Private status page links and signal URLs contain long random secrets. They are stored as-is, because they have to be compared on each request, and are excluded from API output by default.
  • Access logs record the path without its query string, so a private status page link is not written to our logs when someone opens it.
  • Sessions use HTTP-only, HTTPS-only, SameSite=Lax cookies, and every state-changing dashboard request carries a CSRF token.
  • Tenant isolation. Every dashboard request is scoped to the signed-in user's organization.
  • Outbound requests. URLs you give us — webhooks, endpoint checks, the public detector — are refused if they resolve to private, loopback or cloud metadata addresses.
  • Rate limits on sign-in, sign-up, password reset, invitations, the public tools and the public API.
  • Payment cards are entered on Stripe's hosted pages and never touch our servers.
  • Vendor logos fetched from third-party sites are served with a sandboxing Content-Security-Policy, so a malicious image cannot run script on our domain.
  • Anonymous outage reports keep only a keyed hash of the reporter's IP address and user agent.

Hosting: [to be completed]. Disk encryption, backup storage and backup encryption: [to be completed].

Our crawlers

If you run a status page or an endpoint and see us in your logs, this is what we are doing.

  • Blip24Bot/1.0 (+https://blip24.com/security#crawlers) reads public status pages and incident feeds of the vendors in our catalogue, typically between once a minute and once every fifteen minutes, and checks endpoints our customers have asked us to monitor.
  • Blip24Alerts/1.0 (+https://blip24.com/security#crawlers) delivers webhook alerts to destinations our customers configure.
  • Mozilla/5.0 (compatible; blip24/1.0) occasionally fetches a vendor's icon for our directory.

To ask us to poll less often or stop, email [to be completed].

Service providers

The companies that process data for us are on the subprocessors page.