statuswerk

Security & Compliance

This page answers the questions a security review asks: where your data lives, who processes it and how we protect it.

Last updated: November 7, 2026

At a glance

  • Operated and hosted in Germany, at Hetzner Online GmbH. The monitoring probes also run at UpCloud in Amsterdam, Warsaw and Madrid.
  • Run by We Manage GmbH — the same company named in the imprint. There is no further service provider between us and the server.
  • We run our databases ourselves. No managed database provider, no data kept outside our infrastructure.
  • Subscribers' email addresses and phone numbers are stored encrypted.

Where your data lives

Application, databases and files run on servers of Hetzner Online GmbH in Germany. Operations, configuration, updates and backups are done by us — Hetzner provides the infrastructure, not the operations.

HTTP monitoring checks your services from six regions: Falkenstein, Nuremberg and Helsinki at Hetzner, Amsterdam, Warsaw and Madrid at UpCloud. These probes receive only what a check needs — the address and, where set, its credentials —, store nothing and report back only the result.

Your data does not leave the EU.

What we run ourselves

Building blocks many providers buy in as a service run on our own infrastructure — so the data goes to nobody else:

  • Error tracking. Self-hosted as well (Sentry). Error reports from the application do not leave our infrastructure.
  • Databases. No managed database provider.
  • Fonts. Status pages load no fonts from a third-party server. Visitors of your status page open no connection to third parties.

Technical measures

  • Encryption in transit — every connection over TLS, including status pages on customers' own domains, for which we issue and renew certificates automatically.
  • Encryption of subscriber data at rest — subscribers' email addresses and phone numbers are stored encrypted in the database. A database dump does not contain them in plain text. Searching still works through encrypted search indexes, without revealing the values.
  • Tenant isolation — every query is bound to the workspace, in the interface and in the API.
  • API tokens with permissions — "read only" or "read and write" per token, bound to one workspace, with an optional expiry date.
  • Abuse protection — rate limits on every public endpoint: subscriber sign-up, subscriber links, the password prompt of private pages and the REST API.
  • Outgoing webhooks secured — HTTPS only, no internal or reserved address ranges, no redirects, and the target address is checked again before every delivery.
  • Audit log — who changed what in a workspace, with time and IP. Visible to customers on the Pro plan (30 days) and the Business plan (a year).

Sub-processors

These service providers process data on our behalf. There are no others.

Provider Purpose Data processed Location
Hetzner Online GmbH Infrastructure, hosting, backups, monitoring probes All data stored in the application Germany; one probe in Finland
AhaSend B.V. Email delivery to subscribers and users Email address, subject and content of the message Netherlands, processing in the EEA
seven communications GmbH & Co. KG (seven.io) SMS delivery to subscribers Phone number and message text — only for status pages with SMS subscriptions enabled Germany
UpCloud Ltd Monitoring probes in Amsterdam, Warsaw and Madrid A check's address and, where set, its credentials, only for the duration of the check; the result Finland; servers in the Netherlands, Poland and Spain
STACKIT GmbH & Co. KG AI assistant in the support chat Only the text of chat messages — no name, no email address, no account data Germany
Rechnungskit (Happy Coffee GmbH) Subscriptions, invoicing and customer portal Our customers' billing data. No data of your status page's subscribers. Germany
Mollie B.V. Payment processing (through Rechnungskit) Our customers' payment data. No data of your status page's subscribers. Netherlands

We provide the data processing agreement (DPA) on request. We announce changes to this list in advance.

How long we keep data

  • Email delivery logs — 30 days, then deleted automatically.
  • Audit log — 365 days, then deleted automatically.
  • Metrics — 7 days at full resolution, 90 days condensed, 24 months condensed hourly.
  • Subscribers — until they unsubscribe. Whoever unsubscribes is deleted, not just flagged. Unsubscribe links always work, also on password-protected status pages.
  • Incidents and maintenance — as long as you keep them. You can delete them at any time.

Reporting a vulnerability

If you have found a security issue: how to report it to us is in our security.txt. We confirm receipt within two working days and keep you posted on the fix.

Please give us the chance to fix it before publishing anything. We take no legal action against people who look for vulnerabilities in good faith, without causing harm, and report them to us.

Documents and contact

Questions about this page or a security review: info@statuswerk.eu