# Enterprise Security for Your Monitoring | Uptimeify > Encrypted secrets, isolated tenants & tamper-evident audit logs. Enterprise-grade security for agencies & MSPs in B2B audits. Start your free trial. Source: https://uptimeify.io/features/trust-and-compliance/enterprise-security Protect your clients' monitoring data with industry-standard encryption and strictly isolated infrastructure. You build the technical trust that demanding enterprise IT leaders and strict B2B security audits expect, without becoming the security department yourself. Start Free Trial Explore Success Kit ## Enterprise security for your monitoring. At agency simplicity. For the technical stakeholder ### Secret encryption & key management This is how it is wired. Explore the Success Kit Secrets AES-256-GCM unreadable to admins and third parties. Keys Bank-grade key management cycles. Transport End-to-end protection from panel to EU nodes. Encryption Layer ## Encrypted before they rest. AES-256-GCM for your secrets. We treat your clients' sensitive credentials with the utmost care: API keys, passwords, basic auth and custom auth headers are cryptographically secured before they ever touch a persistent storage medium. Unreadable to third parties, and to system administrators. - **AES-256-GCM for all secrets**, so sensitive check parameters rest encrypted, not in plain text. - **Key management to banking guidelines**, so the keys themselves are protected against unauthorized decryption. - **End-to-end in transit**, so data stays secured from the dashboard to the EU nodes. For the technical stakeholder ### Org scope & query binding This is how it is wired. Learn more about Client Accounts Database Monitor settings, metrics and logs isolated at the DB layer. Scope Every REST call bound to its organizational index. Leakage zero cross-tenant exposure prevented by design. Isolation Layer ## Tenants that never touch. Strict multi-tenant logic. In an agency and MSP environment, separation between client accounts is the top priority. The decoupled multi-tenant engine ensures every subaccount runs in its own silo: data, configurations and incident logs stay separated, at the database level. - **Isolated database silos**, so monitoring data, configs and logs sit separated per client. - **Strict organization scope**, so every API request is firmly bound to its organization ID. - **Leakage prevented by design**, so cross-organization disclosure can't happen by accident. For the technical stakeholder ### RBAC model & audit-trail export This is how it is wired. Explore the Success Kit Changes Chronological tracking of every config and permission tweak. RBAC Admin Editor Read-Only scoped at the org tier. Export Structured history download for data controllers. Audit Layer ## Every action traceable. Tamper-evident audit logs. You keep operational control and create transparency for the audit. Every administrative action in your agency account is logged in full: who changed what, when, on monitors, alert rules, contacts or permissions. You assign roles granularly, and the export is audit-ready. - **Complete change tracking**, so every modification is documented chronologically. - **Granular RBAC**, so you assign Admin, Editor or read-only at the org level and keep the attack surface small. - **Audit-ready export**, so you hand out activity logs structured for compliance reviews. For the technical stakeholder ### Bare-metal hardening & DDoS filtering This is how it is wired. View Worker-Node IPs Patching Continuous CVE and zero-day mitigation. DDoS Multi-layer network and application defense. Nodes bare-metal minimal attack surface, max velocity. Infrastructure Layer ## Bare metal, not shared cloud. Dedicated infrastructure. The distributed European network runs on dedicated hardware, with no shared resources. Proactive patch management and multi-layer filters keep telemetry reliable and the attack surface small, deliberately kept lean, so there's less to attack. - **Continuous patch management**, so security updates close CVEs and zero-days promptly. - **Multi-layer DDoS mitigation**, so malicious traffic is filtered at the network and application level before it hits your monitoring. - **Bare-metal nodes**, so unused libraries fall away and both attack surface and latency drop. ### SLA & Contract Templates Service Level Agreement templates to define professional boundaries with your clients. ### Pricing Calculator Find the sweet spot for your care plans. Calculate margins based on check frequency and support hours. ### White-Label Pitch Decks Powerpoint Templates that explain 24/7 monitoring to non-technical clients. Close more retainers. ### Churn-Proof Reporting Guide Use automated reports to proactively communicate value, so clients never ask what they're paying for. Claim your Success Kit and start scaling today. Claim your Success Kit & Start Monitoring Ready to turn monitoring into a profit center? Every Uptimeify subscription includes access to our Success Kit, a collection of battle-tested resources to turn your monitoring into a profit center. ## We don't just monitor. We help you sell. → For the technical stakeholder ### Secret encryption, org scope & bare metal: this is how it's wired Secrets are encrypted with AES-256-GCM before they're persisted; key management keeps keys separate from data, and transport to the EU nodes is TLS-secured throughout. Every API request and DB query is bound to the organization ID, so cross-org access is ruled out in the data layer. The nodes are dedicated bare-metal machines with no shared tenants, with continuous patching and multi-layer DDoS filtering at the network and application level. How are my clients' credentials stored? Sensitive secrets, API keys, passwords, basic auth and custom auth headers, are encrypted with AES-256-GCM before they're written to a storage medium. The plain text is never persisted and isn't readable even to system administrators; it's decrypted only at the runtime of the check. Is different clients' data technically separated from each other? Yes. Every subaccount runs in an isolated database silo, and every API request is firmly bound to its organization ID. Following the privacy-by-design principle, cross-organization access is structurally ruled out. The separation sits in the data layer, not just in the view. Can I trace who changed what in the account? Yes. The tamper-evident audit log records every administrative action chronologically, with actor and timestamp, on monitors, alert rules, contacts and permissions. You hand the structured export straight to internal reviewers or a security audit. Is the data held in the EU, without US sub-processors with data access? Uptimeify is built and hosted in Frankfurt, with a geo-redundant replica across European nodes and without US sub-processors with access to your customer or monitoring data. That minimizes third-country transfer risk and takes a whole discussion off the table in B2B and public-sector conversations. How is the platform protected against attacks and outages? The nodes run on dedicated bare-metal hardware with continuous patch management against CVEs and zero-days. Multi-layer DDoS mitigation filters malicious traffic at the network and application level before it reaches the monitoring, and the deliberately lean node configuration keeps the attack surface small. FAQ ## Frequently Asked Questions Put your monitoring on a security foundation that holds up in a B2B audit, encrypted, isolated, logged. Your data, your control, your proof of trust. ## Ready to walk into any security audit with confidence?