Security you can hand to your auditors
Navy watches your production systems, so we hold ourselves to the same standards you do. Here is how we protect your data and keep the service running.
Audit
SOC 2 Type II
Audited every year by an independent firm.
Certification
ISO 27001
Certified information security management.
Regulation
GDPR
EU data residency and a standard DPA.
Regulation
HIPAA
Business associate agreements on Business plans.
Practices
How we keep your data safe
Infrastructure
Navy runs on two cloud providers in every region, so no single provider can take your monitoring down.
- Isolated environments
- Production is separated from staging and development, with no shared credentials.
- Redundant by design
- Every service runs in at least two availability zones and fails over automatically.
- Daily backups
- Encrypted backups are taken daily, stored in a second region and restored in a test every month.
Data protection
Your monitor settings, check results and incidents are encrypted everywhere they live.
- Encryption in transit
- All traffic uses TLS 1.2 or newer, including traffic between our own services.
- Encryption at rest
- Databases and backups are encrypted with AES-256 and keys are rotated every year.
- Data residency
- Data is stored in the EU by default. Business plans can choose the United States.
Access control
Only the people who need access have it, and every action is logged.
- Single sign-on
- Sign in with Okta, Google Workspace or Microsoft Entra ID, and require it for every member.
- Roles and audit log
- Four roles cover every team, and the audit log records every change to monitors and policies.
- Least privilege
- Navy engineers access production only through short-lived, approved sessions.
Application security
Security is part of how we write, review and ship every change.
- Code review
- Every change is reviewed by a second engineer and scanned for known vulnerabilities.
- Penetration tests
- An external firm tests the dashboard, API and status pages twice a year.
- Dependency updates
- Dependencies are tracked automatically and critical patches ship within 48 hours.
Report a vulnerability
Found something? Write to [email protected]. We reply within one business day, keep you updated until it is fixed and credit you in our changelog if you like.
Need more for your review?
We can share our SOC 2 report, penetration test summary and a completed security questionnaire under NDA.