Security you can hand to your auditors
Navy watches your production systems, so we hold ourselves to the same standards you do. Here is how we protect your data and keep the service running.
Practices
How we keep your data safe
Infrastructure
Navy runs on two cloud providers in every region, so no single provider can take your monitoring down.
Isolated environments
Production is separated from staging and development, with no shared credentials.
Redundant by design
Every service runs in at least two availability zones and fails over automatically.
Daily backups
Encrypted backups are taken daily, stored in a second region and restored in a test every month.
Data protection
Your monitor settings, check results and incidents are encrypted everywhere they live.
Encryption in transit
All traffic uses TLS 1.2 or newer, including traffic between our own services.
Encryption at rest
Databases and backups are encrypted with AES-256 and keys are rotated every year.
Data residency
Data is stored in the EU by default. Business plans can choose the United States.
Access control
Only the people who need access have it, and every action is logged.
Single sign-on
Sign in with Okta, Google Workspace or Microsoft Entra ID, and require it for every member.
Roles and audit log
Four roles cover every team, and the audit log records every change to monitors and policies.
Least privilege
Navy engineers access production only through short-lived, approved sessions.
Application security
Security is part of how we write, review and ship every change.
Code review
Every change is reviewed by a second engineer and scanned for known vulnerabilities.
Penetration tests
An external firm tests the dashboard, API and status pages twice a year.
Dependency updates
Dependencies are tracked automatically and critical patches ship within 48 hours.
Report a vulnerability
Found something? Write to security@navy.test. We reply within one business day, keep you updated until it is fixed and credit you in our changelog if you like.