Engineered with strict zero-leakage cryptographic guarantees, multi-tenant row-level database isolation, and hardened SSRF defenses.
Client certificate private keys (RSA & EC) uploaded for mTLS monitoring are encrypted at rest using AES-256-GCM. Private keys are never exposed in read APIs or sent back to user browsers, strictly synthesized in backend memory for TLS handshakes.
All mTLS probes establish secure in-memory SSLContext instances with dedicated TrustManagers and KeyManagers. Support for custom enterprise Root CAs allows probing private zero-trust endpoints without public exposure.
Every database query in Uptara is explicitly scoped by tenant ID (team_id). Strict authorization checks prevent cross-tenant data leakage or unauthorized probe manipulation.
All target hostnames are resolved against real DNS and validated before socket connection. Internal loopback addresses (127.0.0.1), link-local IPs, private subnets (RFC 1918), and AWS/GCP cloud metadata services (169.254.169.254) are rejected.
Everything you need to know about API uptime, SLA calculations, and monitoring with Uptara.
Client private keys are encrypted using AES-256-GCM before database insertion. Read DTOs explicitly mask private keys (returning hasClientCert=true with clientKeyPem omitted). During probe execution, the key is decrypted in volatile memory to build an ephemeral SSLContext and immediately discarded from memory.