Security and privacy
Hosting
Asniher runs in the EU, in Germany. Your account, monitor configuration, check results and incidents are stored there.
Sub-processors
| Provider | Purpose |
|---|---|
| Paddle | Payments, invoicing and tax, as merchant of record. Asniher does not see or store card details. |
| Amazon SES | Delivery of sign-in links and alert emails. |
| Cloudflare | DNS, network protection and edge services. |
Alert messages are delivered to the third-party services you connect (Slack, Discord, Telegram or your webhook endpoint).
Data retention
| Data | Retention |
|---|---|
| Raw check results (each individual check) | 30 days |
| Aggregated uptime and response-time statistics | About 400 days |
| Incidents and account data | While your account exists |
Downgrading never deletes data; excess monitors are paused. To delete your account and its data, email support@asniher.com from your account email.
Authentication
- Sign-in uses an email magic link or GitHub OAuth. Asniher does not store passwords.
- On the Team plan, each teammate signs in with their own identity.
Request signing
- Outgoing webhooks are signed with HMAC-SHA256 using your channel secret. Verify the
x-asniher-signatureheader as described in Alerts. - Heartbeat URLs contain a random token. Treat them as secrets.
Monitoring traffic
- Checks identify themselves with the user agent
AsniherBot/1.0 (+https://asniher.com/bot). - Monitors can only target public addresses. Private, loopback and link-local ranges are blocked.
- Custom request headers you configure (for example an
Authorizationheader) are stored with the monitor and sent only to the monitor's target. - Public status pages never expose monitor URLs, headers or other configuration.
Your data
Asniher does not sell your data or use it for advertising. See the privacy policy for details.
Reporting a vulnerability
Email support@asniher.com with "Security" in the subject. Include steps to reproduce. Please do not run automated scans or load tests against asniher.com.