Security and subprocessors

Updated September 23, 2026

Hosting and location

The application, its database, its search engine and our mail server run on servers operated by OVHcloud (OVH SAS), a French company, in data centers located in France.

The website and the application are served through Cloudflare, which acts as a reverse proxy: page delivery, protection against denial-of-service attacks and filtering of malicious traffic. Like any reverse proxy, Cloudflare sees the IP addresses, headers and content of requests pass through. Cloudflare, Inc. is an American company with a worldwide network, so we treat this flow as a transfer outside the European Union, covered by the safeguards listed below.

Our subprocessors

Here is the complete list of the providers that process personal data on our behalf. It also appears in our privacy policy.

Emails (alerts, digests, service messages) are sent from our own mail server, hosted by OVHcloud: no email delivery provider is involved. They are DKIM-signed, and our domain publishes SPF and DMARC records.

Notifications you set up towards your own tools (Slack, Microsoft Teams, webhooks) go to the destinations you choose: those services are yours, not our subprocessors.

We do not use your data to train a model. According to Mistral AI’s terms, data sent to its paid API is not used to train its models either; it is kept for 30 days for abuse detection.

Measures in place

This list only contains measures that work today. What is not on it, we do not claim.

Accounts and authentication

• Passwords hashed with bcrypt, never stored in plain text.
• Two-factor authentication with time-based codes (TOTP, RFC 6238), available on every account, with single-use recovery codes. Turning it on closes the other open sessions.
• OpenID Connect single sign-on (SSO) on the Enterprise plan, with verification of the organization’s domains.
• Access tokens valid for 15 minutes, renewed with single-use session tokens valid for 7 days, carried in HttpOnly and Secure cookies.
• Changing or resetting a password closes every session of the account.
• Attempts are rate-limited on sign-up, sign-in, two-factor authentication and password-reset requests, with an alert to our team when the limit is exceeded.

Application and API

• On the application: a strict content security policy (CSP) with a nonce renewed on every request; display inside third-party frames blocked; HSTS, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers.
• On the website: X-Frame-Options, X-Content-Type-Options and Referrer-Policy headers.
• API keys stored only as hashes, revocable, and restrictable to specific families of data.
• SSO connection secrets encrypted in the database.

Infrastructure

• The database, the cache and the search engine listen only on the server’s local interface: they cannot be reached from the Internet. The API can only be reached through the front web server.
• Services are split across separate Docker networks. The application and website containers run without root privileges, without Linux capabilities and with privilege escalation disabled; the application’s container runs on a read-only file system.

Traceability

• Audit log of sensitive actions: sign-ins, password changes, groups and permissions, SSO configuration, inventory changes, administration actions. Kept for 30 days, 2 years or without limit depending on the plan; viewable by the organization’s administrators on the Enterprise plan.

Software supply chain

• We produce a software bill of materials (SBOM) in CycloneDX format from the images actually deployed: system packages, libraries and dependencies, with their exact versions. You can ask us for it for your supplier assessment.

Reporting a vulnerability

Think you have found a flaw in TechWatchAlert? Write to [email protected]. This address is also published in the standard security.txt format (RFC 9116), on the website as well as on the application.

Scope

• In scope: the techwatchalert.com website, and the application and its API on app.techwatchalert.com.
• Out of scope: our subprocessors’ services (report those to the vendor concerned), denial-of-service attacks, social engineering, and reports from automated tools with no demonstrated impact.

Testing rules

• Test with your own accounts. Do not access or modify other users’ data, and keep only what the demonstration requires.
• Automated or intrusive testing (scans, fuzzing, injection) of our infrastructure requires prior written authorization, as provided for in Article 12.3 of the Terms of Use: write to us before running them.
• Give us time to fix the issue before any publication, and let us agree on the date together.

What a useful report contains

• the page, address or API endpoint concerned;
• the steps to reproduce, with the relevant requests and responses;
• the impact you were able to demonstrate;
• how to get back to you.

What we commit to

We acknowledge every report, keep you informed of its handling until it is fixed, and agree with you on the publication date. We take no legal action against anyone who acted in good faith and within these rules, as provided for in Article 12.2 of the Terms of Use.

TechWatchAlert in your NIS2 assessment

If your organization is subject to the NIS2 directive, TechWatchAlert is one of your suppliers: Article 21.2.d asks you to take the security of your supply chain into account. This page gathers what such an assessment usually asks of a supplier. For a questionnaire or a data processing agreement (DPA), write to us.

TechWatchAlert also provides tooling for part of your own obligations: monitoring that includes CERT-FR and the EUVD, a register of accepted risks, remediation deadlines, suppliers, incidents. What the offering covers, and what it does not.