Our current position
Sitemyra is an early-stage product operated as an independent project. We publish the controls we can verify and avoid making claims about certifications or formal audits that have not been completed.
Implemented practices
- Production settings enforce HTTPS redirects, secure cookies, HSTS, and clickjacking protection.
- Application secrets are supplied through environment configuration and are excluded from source control.
- Passwords are handled through Django password hashing; JWT access tokens are short-lived and kept in browser session storage.
- Webhook destinations are encrypted at rest, and developer API keys are stored as hashes rather than raw secrets.
- Monitored URLs are checked for unsafe destinations, private or reserved networks, metadata hosts, unsupported ports, and credential-bearing URLs.
- Production services run as separate Docker workloads with health checks and restart policies.
Data handling in the application
The application stores account information, the URLs and settings you choose for monitors, check results, notification preferences, and delivery records. Webhook secrets are encrypted before storage. The application does not claim to make monitored pages private or to bypass access controls.
Monitoring requests are intended for publicly accessible pages. The URL validation layer blocks private and reserved network destinations, cloud metadata hosts, unsupported ports, and URLs containing embedded credentials. Browser-based checks also validate page requests and redirects.
Deployment boundaries
The production Compose setup separates the web application, API, Celery workers, scheduler, PostgreSQL, and Redis into distinct services. It uses health checks, restart policies, and environment-based secrets. TLS termination is expected to happen at the hosting or edge layer; that edge configuration is outside this repository.
What this page does not claim
Sitemyra does not claim SOC 2, ISO 27001, GDPR certification, a formal penetration test, zero vulnerabilities, military-grade security, or enterprise compliance. No software can promise uninterrupted availability or absolute security.
Reporting a concern
If you find a security issue, use the contact page and describe the issue without sending passwords, API keys, webhook secrets, or payment details. Please allow a reasonable amount of time for the founder to investigate before public disclosure.