SECURITY

What we do with your data, in plain facts

Where DevHelm runs, how data is encrypted, who can access it, how browser runs are isolated, what we keep and for how long, and who processes it.

We don't hold SOC 2 or any other certification today. Below is what we can state precisely, reviewed against our code.

Last reviewed 6 October 2026

Ask a security question

KEY FACTS

The facts a security review asks for

One claim per line, grouped in the order a vendor review asks. Ask us to show any of them.

Hosting and data location

Hosting: DigitalOcean, New York (nyc1). The app, API and primary database run there.
Other storage: Synthetics packages and run evidence: DigitalOcean Spaces, London. Database backups: AWS S3, us-east-1.
Check regions: Uptime and Synthetics checks run from four regions: us-east, us-west, eu-west and ap-south.

Encryption and secrets

In transit: TLS on every public endpoint. HTTP redirects to HTTPS.
At rest: Disks and object storage use the providers' at-rest encryption.
Customer secrets: AES-256-GCM. Each workspace has its own data key, wrapped by an AWS KMS key that rotates automatically.

Access

Workspace roles: Owner, Admin and Member.
Sign-in: Through Auth0, including Google sign-in. SAML SSO: coming soon (Business and Enterprise).
Audit log: Records membership and role changes, invites, API-key changes and webhook-endpoint changes.

Synthetics isolation

Sandbox: Each run, browser or multi-step API, executes in its own gVisor sandbox: all Linux capabilities dropped, read-only root filesystem, private scratch space.
Network egress: Public addresses on TCP 80/443, plus DNS. Internal networks, cloud metadata endpoints and other sandboxes are unreachable.
Egress IPs: One fixed IP per region.
Secrets in a run: Reach your spec as environment variables (process.env.NAME). Masked in network logs, HAR, console and runner logs. Not masked in screenshots, video or traces.

Retention

Raw check results: Readable for 90 days on Free, Starter and Pro; 180 days on Team, Business and Enterprise.
Synthetics run evidence: Screenshot, video, Playwright trace, network log (HAR) and console: 14 days on every plan, then deleted.
Webhook and Email Testing events: Event history by plan: 3 days (Free), 7 (Developer), 30 (Team), 90 (Business), 365 (Enterprise).

Backups

Database: Continuous write-ahead-log archiving to AWS S3 for point-in-time recovery, with a recovery point of about 60 s. Plus a full backup weekly.
Volumes: Snapshots every 6 hours.

Subprocessors

DigitalOcean: Hosting and storage
AWS: Key management, email delivery, backups, logs
Auth0: Sign-in
Paddle: Billing
Cloudflare: DNS, status-page custom domains
Sentry: Error tracking
PostHog: Product analytics
Loops: Product email
Twilio: SMS and voice
Intercom: Support chat
Anthropic: Internal AI tooling

Questionnaires and reports

Security questionnaires: Answered by our team. Send yours through the contact form.
Vulnerability reports: Through the contact form, topic "Enterprise or security review". A person on our team picks them up.Contact the team

Ask a security question

FAQ

What reviewers ask next

Questions the list above doesn't settle.

Do I need to install anything in my network?

No. Checks run from our four regions over the public internet and reach only what is publicly reachable. Private locations are coming soon on Enterprise.

Can I choose a data region?

Not today. Every workspace uses the same locations.

Do I need to allowlist your IPs?

Only if your app blocks unknown traffic. Synthetics traffic leaves from one fixed IP per region; ask through the contact form and we'll send all four.

Contact the team

Which account should a browser check log in with?

A dedicated test account with the least access it needs. Anything a page shows on screen can appear in the screenshot and video.

Ask a security question