Security

The monitoring service you trust to watch your systems has to be worth trusting itself. This page is the plain-language version of how PylonMon protects your account and your data — every item here is a live property of the product, not a roadmap slide.

Your account

• Passwords are never stored — only salted PBKDF2 hashes, compared in constant time.
• Two-factor auth (TOTP) with single-use recovery codes, on every plan.
• Google sign-in and enterprise SSO (OIDC) — bring Okta, Entra ID, Auth0, Keycloak, or Google Workspace. Members created through your IdP are IdP-managed: password sign-in is disabled for them, password resets are refused, and their sessions are capped at 24 hours — offboarding someone at your IdP ends their PylonMon access within a day.
• Roles (owner / admin / write / read) scope what each member can touch; sessions are HttpOnly cookies.

Your data

• We never sell your data. Not to anyone, not ever — it's in our terms.
• TLS everywhere: browser to us, us to your monitored endpoints, and to the database.
• Tenant isolation: every workspace's monitors, events, and channels are scoped to that workspace on every query — one customer can never see another's data.
• Managed, backed-up storage: state lives in a managed PostgreSQL cluster with automated backups, reachable only from our application nodes.
• Deletion is real: closed accounts are purged after the retention window, and account deletion is self-serve.

Payments & email

• Stripe handles every payment. Card numbers never touch PylonMon's servers.
• Mail you can trust: our sending domain enforces SPF, DKIM, and a strict DMARC reject policy — mail claiming to be PylonMon that isn't gets refused by your provider, not filed next to the real thing.

Operations

• Off-site by design: PylonMon runs on independent infrastructure, outside your network — it keeps watching (and paging) when your environment is dark.
• Redundant nodes: an active-active pair behind a load balancer; deploys are rolling and drain traffic first, so updates don't drop requests.
• Least surface: a single static binary, no third-party analytics or tracking scripts on the product, first-party cookies only.

Compliance & disclosure

We're a small, security-minded team. SOC 2 is on our roadmap and we're happy to walk your security review through our practices directly — ask. Found a vulnerability? Email support@pylonmon.com with a way to reproduce it; reports land in front of an engineer, we'll acknowledge quickly, and we won't take legal action against good-faith research.