Security

Encryption in transit

All traffic to and from StatusMirror is encrypted with TLS (HTTPS), with HTTP Strict Transport Security (HSTS) enabled to force secure connections.

Authentication

Sign-in uses one-time passcodes delivered by email — no passwords are stored. Codes are cryptographically generated, expire quickly, and are stored only as hashes, never in plaintext. Failed verification attempts are rate-limited per email address.

Session tokens are signed (RS256) and kept only in your browser: in local storage when you choose “Keep me signed in”, and otherwise only in memory for the current session.

Application security

Every page is served with a strict Content-Security-Policy (per-request nonce), and responses include clickjacking, MIME-sniffing, referrer, and permissions protections. Payment webhooks are verified with cryptographic signatures before being processed.

Data protection

Personal data is processed under our Privacy Notice (DPDP Act 2023), and you can request access, correction, or erasure at any time from support@statusmirror.com.

Our Privacy Mode feature masks sensitive values on screen (API keys, emails, URLs, metrics) and can be toggled from the app.

Reporting a vulnerability

Found a security issue? Email security@statusmirror.com and we will respond as soon as possible. Please include steps to reproduce and avoid sharing exploit details publicly until we have had a chance to respond.