Security
A monitoring service holds a map of what matters to you: your endpoints, your schedules, sometimes your tokens. This page says plainly what protects that map, and it labels every control by its real status. Nothing here is aspirational marketing.
Controls
Implemented means live today. In progress means actively shipping. Planned means committed but not started. A control never moves up this ladder in marketing before it does in code.
The public site collects what you give it: signup details through our identity provider, and the contents of the contact form. Analytics are privacy-conscious and do not build advertising profiles.
All traffic is HTTPS. The site ships strict security headers, and no secrets or internal configuration reach the browser.
Contact submissions are stored with row-level security and are not readable by other visitors under any circumstance.
Authentication is handled by a dedicated identity provider rather than a homegrown password system.
Every account's monitors, incidents, and history are separated at the database layer with row-level security policies, not just application checks.
Request headers and tokens you give a monitor are encrypted at rest, used only for the checks you configured, and never displayed back in full.
Probes refuse private networks, loopback addresses, and internal metadata endpoints, so Fajita cannot be used to scan infrastructure it should not reach.
Rate limits and target validation prevent monitors from being used to harass third parties.
Monitoring history and account data can be exported in a documented format. Your uptime record is yours.
Deleting an account removes its data on a documented schedule. Retention windows are described in the privacy policy.
Boundaries
What we do not claim
Fajita holds no SOC 2, ISO 27001, or HIPAA certification and has not completed an external penetration test. If any of that changes, it will be announced here with evidence, not a badge.
Your side of the deal
Use scoped, read-only credentials for authenticated monitors where your API supports them. Do not point monitors at systems you do not own or operate. Keep your account credentials to yourself.
Unsupported use
Fajita is not for monitoring third-party infrastructure without permission, load testing, or scanning. Probes are rate-limited and target-restricted by design.
Reporting a vulnerability
Found something? Use the contact form with the security topic, or read the Responsible Disclosure Policy. A person reads every report and responds.
Policies and documentation
See the Privacy Policy, security documentation, and the Subprocessor List for customers who need processor details.
Open source
Open source does not automatically make software secure. It does make the monitoring logic inspectable and the security posture reviewable.
Public source
The Fajita monitoring platform is published under AGPL-3.0. Security researchers and operators can review how checks, verification, and notifications behave.
Responsible disclosure
Report vulnerabilities through responsible disclosure or the repository SECURITY.md. Do not open public issues for security reports.
Self-hosted operators
You control infrastructure, secrets, backups, and network boundaries. Private network monitoring requires an explicit opt-in on self-hosted installs.
Next