legal

Security & Technology

How Calmping is built and how it protects your data. Security reports can be submitted through the contact page.

1. Data protection

Passwords hashed with bcrypt (never stored in plaintext).
Integration keys, webhook URLs, and 2FA secrets encrypted at rest with AES-256-GCM.
Session and CSRF cookies are HttpOnly and use the __Host- prefix in production.
API tokens are stored only as hashes and can be scoped and revoked.

2. Tenant isolation

Every record is bound to an account and access is checked on every request, so one customer cannot read or modify another's data.

3. Anti-abuse

Outbound monitoring passes through an SSRF guard that blocks private, loopback, and reserved network ranges (except where an owner-run private instance explicitly opts in). Requests are rate-limited and size-limited.

4. Reliability

Alerts are stored durably before delivery and retried automatically after temporary failures. The database is snapshotted on a schedule; a dead-man switch can watch the monitor itself.

5. Account security

Optional two-factor authentication, single-use recovery codes, cross-IP login throttling, and an audit log of sensitive actions.

6. Responsible disclosure

If you believe you have found a vulnerability, use the contact page. Do not test against other customers or attempt to access data that is not yours.

7. Stack

Node.js and Express, an embedded SQL database, and a zero-build front end (plain HTML, CSS, and JavaScript) with a strict Content-Security-Policy and no third-party scripts or trackers.