Changelog

We still use both as fallback resolvers, but they only resolve public hostnames under their own terms, like the root and TLD nameservers we never listed, so they are no processors under Article 28 GDPR and leave the subprocessors page.

When several alerts for one account went out at once, they used to collide on that single connection and the losing one was discarded without ever reaching a mailbox; they now spread over three, and one that still finds them all busy is retried for up to 90 seconds.

A channel set to notify immediately now does so even when another channel on the same monitor waits ten minutes, and the channel priority field is gone, so channels that were staggered by priority alone now all fire at the same time.

Nothing changes for you until you connect an agent and grant it write scopes, a read-only connection stays read-only, every write records the person who authorized it, and a call that would move you to a higher paid quota tier is refused unless it says so explicitly.

A custom domain whose weekly TXT re-check fails now stays active and keeps serving traffic and certificates, and we look at the report and contact you rather than switching the domain off in the background.

A single AAAA record pointing at one host cannot fail over and would have sent certificate validation to the wrong server during the move, so IPv6 visitors reach the site over IPv4 until the record returns.

One monthly email per customer replaces one email per website, now covers every monitor type instead of only websites, and a monitor with no checks in the period shows a dash instead of a false full uptime figure.

A mail server we do not run, cannot reach and cannot test could never have measured our machinery, every attempt records which sender it went through, so this is read off the record rather than guessed, and a failing mail server stays visible in your history.

Your device generates a key pair on registration and keeps the private half in the system keystore, the text is encrypted before the push leaves us so Apple and Google carry bytes they cannot open, and a device without a key gets the generic line rather than nothing.

Google Workspace never touched monitoring data but did hold the correspondence itself, so the content of your support emails is now processed in Germany rather than under the EU-US Data Privacy Framework, and one US linked sub-processor leaves our list.

The push carries a wake signal, an alert identifier, the severity and a signed acknowledgement token and no monitoring data at all, the apps are optional and alerts keep reaching you by email, SMS, voice and webhook, and the objection period starts today.

Agreement now counts as evidence and is filed as a certificate problem with the browser's own reason rather than a generic outage, while a complaint from the browser alone still confirms nothing, which keeps the load balancer and CDN cases suppressed as before.

A cache is a poor home for something that has to survive a handover such as the new consent screen for AI assistant connections, nothing new is collected or shared, the values expire on the same short schedule, and both cache and database run on infrastructure in Germany.

Monitors, incidents and check history are three separate checkboxes and a cleared one keeps that area out of the connection for good, a tool the assistant may not use is not offered at all, and a client asking us to skip the screen gets a standards-compliant refusal.

The browser got only the time left over but was judged against the full check timeout, so a browser that spent its whole window failing counted as proving nothing, it is now judged against the time it actually had, and every failed check leaves a 90 day record.

Booking lives at /book-a-call with a direct link below the calendar in case it cannot load, we learn that a booking completed and which page the visit began on and nothing more about you, and name, email address and chosen time go where they always did.

A domain you look up is your business and had no place in a report about which page was visited, so we set the address explicitly instead of letting the script read it, and we record only the tool name, whether it succeeded, and the kind of input.

The container held two entries in two years and is switched off, which removes a request to a Google host and about 375 kB of script per page, and our measurement now lives in the same repository, code review and tests as the rest of the site.

You pick a slot directly and get a confirmation in your inbox instead of joining a callback queue, the service is the open source edition of Cal.com running on our own machine, and no third-party booking provider, external calendar widget or tracking script is involved.

Monitoring a search or filter endpoint used to mean POST, which claims the request changes something, the body field behaves as it does for POST and stays encrypted at rest, and a target answering 405 is telling the truth about itself, which the monitor passes on unchanged.

A share link carries a random identifier, is excluded from search engines and sitemaps and cannot be browsed, we store a result only when you ask for a link, and a suggestion appears only where the result maps to something we genuinely watch.

You find them in the incident evidence, in the alert email and in a new blocking_response field in the webhook payload, we name a known provider such as Cloudflare or Imperva where the response identifies one, and the header list never includes cookies or credentials.

One unstable monitor produced around 110 incidents in eight hours, a failure of the same cause now reopens the incident already on record and keeps its start time, and availability is untouched because uptime comes from check results, never from the incident list.

Every location stopped its DNS resolvers and its workers on the same signal but gave the workers up to a minute to drain, so the last few checks lost name resolution halfway through and crossed their own time limit, and the resolvers now stop last and start first.

Our routing fix was real but was not the cause, we now believe SpamCop's free public list rate-limits the addresses we query it from, using it at our volume would mean licensing the data feed, and we will not switch it back on again on a guess.

A resolver configuration file that gives each blocklist zone a direct path had never actually been read, so months of overrides had no effect at all, and once it was loaded the median blocklist job fell from around 22 seconds to under 5.

SpamCop was answering reliably but far too slowly at every location, which timed out against our per-lookup budget, so while it is paused an IP listed only there raises no new alert and an existing listing does not refresh, and the other blocklists are unaffected.

A worker host runs around twenty containers, so a per-machine number showed pressure but never which part caused it, the per-container metrics go to the same self-hosted SigNoz instance our traces use and say nothing about your monitors or targets.

Charts, uptime figures, reports and status bars are unchanged over the same period, what changes is that a check log or incident timeline entry older than 48 hours reads as one line per minute with counts instead of one line per location, flagged by a resolution field in the API.

Full detail survives a whole annual cycle, twice the window most incident tools open, the nightly aggregate is written before anything is deleted and is part of your data export, and an incident older than twelve months leaves the list and the API even if it was never resolved.

The old path keeps a permanent redirect, UptimeifyToolsBot now advertises a URL that actually exists and has its own spec card next to SiteMonitorBot and UptimeifyStatusBot, and you can enter a domain to see the answer your server gives our real check User-Agent.

Where an organisation has configured its own SMTP server every subscription email goes through it and otherwise through Lettermint, the address, consent timestamp, IP and user agent are stored as proof of consent, and unconfirmed signups are deleted after seven days.

We could previously see that a server was healthy and a check ran but not where a slow request spent its time, the traces carry request timing and internal operation names, they are kept for 15 days, and nothing leaves our infrastructure, so no provider is added.

The scheduler recorded when it dispatched a check rather than which minute the check belonged to, so a cycle that started a few seconds late made the next one look not yet due, and it now records the minute itself, which restores the full 60 checks an hour on those monitors.

Screenshots and Playwright monitors used to arrive as an anonymous Chrome and now append our token to a normal Chrome User-Agent so a WAF does not block a real user journey, and the constant header is the more reliable signal because a proxy can rewrite a User-Agent.

Nothing about the feature changes, an address reads <token>@alerts.uptimeify.io, webhook alert sources on our main domain are untouched, and if you already hold an address on the old domain, create a fresh email alert source to get one on the new one.

Only the cookie-free variant of Leadfeeder runs on our public site, your IP address is matched against a company database and then truncated or discarded, identifying a person is not the purpose, and it still never runs inside the monitoring application.

Both nodes run on IONOS Cloud inside the EU, their addresses are published at uptimeify.io/ips.txt ahead of taking traffic so a firewall allowlist can be updated before checks start, and each appears as its own component on our status page.

IONOS Cloud fills the same role Hetzner, OVH, netcup and UpCloud already fill, what crosses those nodes is monitoring data, meaning the check results of the systems you watch, and the full list stands on our subprocessors page.

This makes an existing entry more precise rather than moving anything, no new provider is involved, the locations stay Germany and Finland inside the EU, and nothing about the processing changes for you.

The figure counts the share of scheduled check cycles our network actually ran and is always published next to the measurement coverage for the same period, so minutes we could not measure are never quietly read as healthy, and alert delivery is published beside it.

This corrects an incomplete entry rather than a change in processing, seven.io has placed those calls since voice alerting existed, it remains a German company, and it receives for a call what it already received for an SMS, the number and the notification text.

Zeeg GmbH handled demo, sales and onboarding bookings made through our website and processed the name, email address and meeting details of whoever booked, no data reaches it any more, and it never had access to your account or monitoring data.

Monitoring pauses 14 days after signup, a warning email goes out seven days before deletion and the account is removed 30 days after the pause unless a payment method is added, the data export stays reachable throughout, and every account existing today keeps 14 full days.

The bundle covers customers, monitors, incidents, maintenance windows, channels, status pages, reports, billing and check history, each record is written as JSON and CSV with a manifest of row counts, credentials are redacted, and the ZIP sits in our German object storage.

The fleet still spans seven European locations and checks no longer originate from Switzerland or Czechia, so if you allowlist our nodes in a firewall, re-read uptimeify.io/ips.txt, which is the authoritative list, and review monitors pinned to a retired country.

Uptimeify watches itself with Uptimeify, so a container swap used to open an incident on our public status page for something planned all along, and a release now shows as planned maintenance in a window that expires by itself even if the pipeline dies mid-run.

The server only pulls a finished, version-pinned image and swaps the container, which shortens deploys and the maintenance window and lets one artifact run on several hosts, and with database and cache on their own clusters the application host stores no customer data.

You confirm a short code on the claim page, the agent then receives a read-only token scoped to your organization or to the single customer your role is limited to, it can never create, change or delete anything, and you can revoke it at any time.

Settings, Connected applications lists each connection, for example Claude linked to our MCP endpoint, revoking one disconnects it at once and forces a fresh approval to come back, and every connection is read-only and scoped to your own account.

With an Uptimeify API token in the authorization header an agent can list your website monitors, read a monitor's status, list recent incidents, fetch check history and get an uptime summary, scoped exactly like the REST API and read-only throughout.

Claude and other MCP clients can connect over OAuth 2.1 instead of a pasted token, the connection grants read-only access to exactly what your account already sees and can never create, edit or delete anything, and it runs on our existing application infrastructure.

An agent discovers the server through the standard well-known documents, registers anonymously, exchanges a signed identity assertion for a short-lived opaque token and can revoke it again, and those tokens are hard-gated to read-only requests on an explicit allowlist.

easybell provides the SIP trunk and cloud PBX behind our company phone line, Zeeg processes the name, email and meeting details of whoever books a call on our website, both sit in Germany under a data processing agreement, and neither reaches your monitoring data.

A stateless endpoint offers around twenty anonymous, read-only tools covering TLS inspection, DNS and mail deliverability, HTTP headers and redirects, WHOIS, blocklists and reachability, discoverable through our MCP server card and usable without an account.

Both providers broaden the infrastructure your checks run from, both operate inside the EU, and because a check node sees the hostnames of monitored targets and their results, each is now listed on our subprocessors page.

That layer previously hung on a single instance and now spans three nodes on our own EU infrastructure where Sentinel promotes a replica and reconnects the workers by itself, so scheduling and alerting survive a node failure without anyone intervening.

The fallback our local resolvers use when they are momentarily saturated now sits entirely inside the EU, DNS.SB is unfiltered and keeps no query logs, DNS4EU remains our other fallback, and the subprocessors page names DNS.SB in place of Quad9.

You can forward an alert email from any tool that sends one to a dedicated address and we turn it into an incident just like a webhook alert, with Lettermint (Netherlands, EU) receiving the message and handing sender, subject and body to us over an authenticated webhook.

SMS and voice are the last line of alerting and until now depended on a single carrier, so LOX24 sits on cold standby, receives nothing but the recipient's phone number and the notification text when it is used, and is now on our subprocessor overview.

Each node resolves through local caching DNS resolvers on our own Hetzner infrastructure, and a burst of concurrent checks could push them into a transient failure that a check read as the target being down, so we raised their headroom and widened the retry window.

Our local resolvers previously forwarded to a single upstream, so a moment of saturation there could surface as a resolution failure and a false alert, and because a fallback resolver may see the hostnames we monitor, both are named on our subprocessors page.

A TCP Port monitor checks from our European fleet that a host and port accept a connection within your timeout, optionally matching a substring of the service banner, and the existing protocol monitors gained the same bare reachability mode for hosts you have no credentials for.

Ubicloud processes our source code and build secrets during a pipeline run and no customer monitoring data at all, and because its parent company sits in the United States we cannot fully exclude a US access path, which is covered by standard contractual clauses.

Managed monitors behave exactly as before, a self-service monitor is created and edited by the customer within a package quota and pages only that customer's recipients, and every existing monitor was classified managed, so nothing changed until you enable self-service.

The database moved off a single-node container onto a Patroni-managed PostgreSQL cluster that promotes a replica by itself, with provisioning and backups handled by a separate infrastructure stack, and all data stays on our own infrastructure in Germany.

ICMP, SMTP, SSH, FTP, IMAP/POP and DNS checks moved onto a single engine at every location, so response times for the protocol monitors measure the connection itself rather than including DNS resolution, and DNS monitors finally match TXT records longer than 255 characters.

Maintenance windows now reliably suppress blocklist notifications, blocklist and domain-expiry alerts reach every integration channel including Telegram, Opsgenie and PagerDuty, and a redirect loop is verified in a real browser with a screenshot before it can alert you.

fastmon collects page-load and performance telemetry from visitors of our web application so we can measure front-end speed, it is hosted in Germany, it sees no monitored URLs or check results, and it is listed on our subprocessor overview.

Leadfeeder reveals which companies visit our public site so we can follow up on sales interest, it runs only after explicit cookie consent, never inside the monitoring application, and it processes no monitoring data.

The product documentation moved to its own subdomain on the same Hetzner application server in the EU, every previous link under uptimeify.io/docs keeps working through a permanent redirect, and nothing about where your data goes changed.

Checks previously ran over IPv4 only and now use whichever address family a site publishes, the way a real visitor reaches it, which removes the false connection failures a check could report when a target was reachable over IPv6 alone.

Our privacy policy listed Cloudflare as a provider for DNS and CDN, which was never true, and the section is gone from both language versions; error tracking runs self-hosted on Bugsink in Germany, so no error data leaves our own infrastructure.

Our subprocessor overview is now public and lists every third party involved in running Uptimeify, whether it touches monitoring data and where it sits, and every future change to it will be announced here and in the RSS feed.