Engineered with strict zero-leakage cryptographic guarantees, multi-tenant row-level database isolation, and hardened SSRF defenses.
Client certificate private keys (RSA & EC) uploaded for mTLS monitoring are encrypted at rest using AES-256-GCM. Private keys are never exposed in read APIs or sent back to user browsers, strictly synthesized in backend memory for TLS handshakes.
All mTLS probes establish secure in-memory SSLContext instances with dedicated TrustManagers and KeyManagers. Support for custom enterprise Root CAs allows probing private zero-trust endpoints without public exposure.
Every database query in Uptara is explicitly scoped by tenant ID (team_id). Strict authorization checks prevent cross-tenant data leakage or unauthorized probe manipulation.
All target hostnames are resolved against real DNS and validated before socket connection. Internal loopback addresses (127.0.0.1), link-local IPs, private subnets (RFC 1918), and AWS/GCP cloud metadata services (169.254.169.254) are rejected.
Architected to satisfy US SOC 2 Type II trust principles and the UK Data Protection Act 2018 / EU GDPR. We enforce strict data minimization: Uptara never stores end-user payload data, only recording cryptographic handshakes, headers, and latency metrics.
Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendums (IDTA) are available for enterprise procurement. Probes operate within dedicated Tier 1 zones in the US (N. Virginia, Oregon) and UK/Europe (London, Frankfurt).
Client private keys are encrypted using AES-256-GCM before database insertion. Read DTOs explicitly mask private keys (returning hasClientCert=true with clientKeyPem omitted). During probe execution, the key is decrypted in volatile memory to build an ephemeral SSLContext and immediately discarded from memory.
No. Uptara operates under a strict zero-retention data minimization principle. For HTTP and synthetic assertions, response bodies are evaluated in volatile memory against user-defined regex or JSON schema expressions and immediately discarded. Only pass/fail assertion outcomes, status codes, and latency telemetry are persisted.
Yes. We provide comprehensive enterprise DPAs incorporating Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendums (IDTA) compliant with the UK Information Commissioner’s Office (ICO) and US data protection standards.
No. Public status pages are served from a globally distributed edge CDN with isolated caching layers, ensuring status communication remains operational even if backend services experience outages.
Explore connected platform capabilities, in-depth engineering guides, and interactive developer utilities.
Free reliability tools for developers and engineering teams detecting downtime, tracking response latency, and calculating real SLAs with Uptara.