Security

The credentials and secrets you provide for monitoring are stored encrypted in a dedicated secrets store and are referenced by the platform rather than embedded in your configuration. A secret is only resolved in memory for the duration of a single check run, then dropped.

We never:

• Return secrets through any API.
• Write secrets into monitoring results, alerts or logs.
• Store secrets in cleartext anywhere durable.

Each resolution is recorded in an access audit trail that captures the secret's name and context — never its value.

Vigil is multi-tenant, and every tenant's data is isolated at the database layer using row-level security. Queries are scoped so one tenant can never read or write another tenant's projects, units, results or secrets.

Data is encrypted in transit using TLS. Secrets are encrypted at rest, and our infrastructure providers encrypt stored data at rest at the disk level.

Some checks are intrusive — they actively probe a target for security headers, exposed secrets, open ports or similar. These run only against units you have verified you own or are contractually authorized to test. Unverified units are skipped for intrusive checks, and the most sensitive checks fail closed until authorization is established.

You are responsible for having authorization to monitor the targets you configure, as set out in our Terms of Service.

Access to production systems is restricted to the operators who need it, protected by strong authentication. We follow the principle of least privilege and review access as our team and infrastructure change.

Vigil runs on reputable cloud infrastructure providers with their own robust physical and network security programs. We keep our platform components and dependencies up to date and monitor for known vulnerabilities.

If you believe you have found a security vulnerability in Vigil, we want to hear from you. Please email hello@getvigil.online with:

• A description of the issue and its potential impact.
• Steps to reproduce it, or a proof of concept.
• Any relevant configuration or environment details.

Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and do not access or modify data that is not yours while testing. We will not pursue action against researchers who report issues in good faith and follow this policy.

How we collect, use and retain personal data is described in our Privacy Policy. You remain the owner of the data and credentials you upload to Vigil.