What we hold, and what we never touch
Monitoring a certificate does not require access to the server it is on. Everything below is either a setting you can read off this page or a property of how the checks work, not a promise about intentions.
Hosted in the EU
Application servers and the database run on infrastructure in Germany, operated by Hetzner Online GmbH. The same provider and location are named in the processor table of our privacy policy, because a claim on a marketing page and a GDPR Article 28 disclosure should be the same sentence.
| Application & database | Hetzner Online GmbH | EU · Germany |
| Transactional e-mail | Germany | EU |
| Payments | Stripe, Inc. | USA · SCCs |
Full detail, including retention periods and your rights under the GDPR, is in the privacy policy.
The check is read-only, by construction
Not by policy. There is no mechanism by which it could be otherwise.
No private keys
CertWatchr opens an ordinary TLS handshake to the host and port you enter, exactly as a browser does, and reads the certificate the server presents. A certificate is public information, sent to everyone who connects. The private key never leaves your server, and there is nowhere for us to put it.
No agent, no access
Nothing is installed on your side. There are no credentials to hand over, no SSH key, no API token into your infrastructure. If you stop using the service, there is nothing to uninstall and nothing left behind.
Only what a visitor sees
We store the hostname, the port, and metadata from the certificate itself: issuer, validity dates, fingerprint, serial. No page content is fetched and no request is made beyond the TLS handshake.
Your account
Specifics rather than adjectives. Each of these is a setting, not an aspiration.
Passwords
Hashed with Argon2, the algorithm the Password Hashing Competition selected. Plaintext is never written to the database or to a log.
Two-factor authentication
Authenticator-app TOTP, opt-in per account. The shared secret is encrypted at rest and recovery codes are encrypted separately. Second factors by e-mail are deliberately not offered: the inbox that receives them can already reset the password, so it is not a second factor.
Brute force
Sign-in and registration are rate limited per client address. The limiter counts in shared storage rather than per worker process, so the limit is the limit however many processes are running.
Deletion means deletion
Deleting your account removes the domains, alert history, health-check history and observed certificates with it, in one transaction. It requires your current password and typing DELETE, because it cannot be undone.
The application itself
- HTTPS enforced, with HSTS set for a year. Session cookies are Secure, HttpOnly and SameSite.
- A Content Security Policy restricting scripts, styles, fonts and connections to this origin. Inline scripts carry a per-response nonce.
- Every state-changing request is CSRF-protected.
- No third-party analytics, advertising or social pixels. No fonts, scripts or stylesheets are loaded from anyone else's servers. The page makes no request off this origin at all.
- Country lookup for the access log uses a database on our own servers, not a third-party geolocation API, so no visitor address is sent anywhere.
- Access-log entries are deleted automatically after 180 days.
Found something?
If you believe you have found a vulnerability, tell us before telling anyone else and we will work the fix with you. We do not run a paid bounty, and we will not threaten you for reporting in good faith.
Report a security issue