A real sample security pack
Public-source specimen: Healthchecks.io. An independent demonstration generated from public Healthchecks.io documentation. Healthchecks.io did not provide or endorse this sample.
This sample uses third-person language and cites public sources. It does not claim that the company supplied an attestation. The pack is shown without edits in the format a buyer receives.
Method: Public-source review of the hosted service and its open-source repository; each cited page was fetched successfully before the production generation pipeline ran. No private access or vendor questionnaire responses were used.
Scope: Healthchecks.io hosted-service controls documented on the cited pages as of 2026-10-28. Unpublished controls are labelled “not evidenced,” not treated as absent.
Sources reviewed on 2026-10-28:
Healthchecks.io — Security & Trust
Based on public information about Healthchecks.io reviewed on 2026-10-28. Independent Trustpack demonstration; not provided or endorsed by Healthchecks.io, and not an audit or certification.
Overview
Healthchecks.io is an open-source hosted service that monitors cron jobs and scheduled tasks. The public FAQ identifies a one-person operations team. Its public record documents hosting, encryption in transit, encrypted off-site backups, and a published Data Breach Policy. No Healthchecks.io security certification was evidenced, and several common controls were not evidenced in the reviewed public sources.
Infrastructure & Hosting
- Hosting: Hetzner bare-metal servers.
- Data region: Germany.
- Certification: No Healthchecks.io security certification was evidenced. Its hosting provider, Hetzner, states ISO 27001 certification.
- Backups: Daily PostgreSQL backups are GPG-encrypted and stored off-site. According to the privacy policy, database backups may retain deleted information for up to 2 months.
- Database resilience: A PostgreSQL hot standby is documented, and database failover is manual. No separate disaster-recovery runbook was evidenced in the reviewed public sources.
- Status: A public status page is available at https://status.healthchecks.io/.
Data Protection
- Data categories stored:
- account email address and optional password
- billing and contact information
- notification-service credentials
- support messages
- browser and server logs
- IP address, device and referral data
- time zone
- customer-supplied check data
- Encryption in transit: Client-to-server traffic uses HTTPS. Traffic between servers uses WireGuard.
- Encryption at rest: Primary database data is not encrypted at rest. Off-site database backups are GPG-encrypted, and subprocessors do not hold the key.
- Deletion: Customers can close their account. Inactive accounts close after 1 year plus a 30-day notice. Deleted information may remain recoverable in database backups for up to 2 months.
- Export: Customers can request access and portability under the privacy policy. Project and check data are also available through the documented API.
- GDPR: The privacy policy supports these data-subject requests:
- access
- correction
- deletion
- processing restriction
- objection
- portability
Access & Authentication
- Customer sign-in: Accounts use an email address with an optional password. The open-source service also documents WebAuthn two-factor authentication.
- Production access: The public FAQ identifies a one-person operations team. No more granular production-access policy was evidenced in the reviewed public sources.
- Staff 2FA: Not evidenced in the reviewed public sources.
- Customer SSO: Not evidenced in the reviewed public sources.
- Staff devices: Not evidenced in the reviewed public sources.
Monitoring & Vulnerability Management
- Vulnerability reports: The public repository security policy directs vulnerability reports to contact@healthchecks.io.
- Vulnerability monitoring: The privacy policy states that vulnerability monitoring is performed regularly.
- Source code: The BSD-licensed source code and its change history are public at https://github.com/healthchecks/healthchecks.
- Logging: The privacy policy documents logs covering browser, device, server, IP address, referral, access time, and operating system. A retention period for those logs was not evidenced.
- Incident response: The published Data Breach Policy covers reporting, containment, investigation, customer notification, remediation review, and a public incident report.
- Breach notification: Affected customers are notified without undue delay. A supervisory authority is notified within 72 hours when required.
- Penetration testing: A third-party penetration test was not evidenced in the reviewed public sources.
Subprocessors
| Name | Purpose |
|---|---|
| Hetzner | Hosting and data storage |
| Amazon Web Services | Encrypted database backups |
| Twilio | SMS and WhatsApp delivery |
| Braintree | Payments |
| Fastmail | Email hosting |
Current Posture & Public-Evidence Gaps
Documented in the cited public record
- Hosting on Hetzner bare-metal servers, with customer data in Germany
- Hetzner's stated ISO 27001 certification, which applies to the hosting provider only
- Daily GPG-encrypted off-site PostgreSQL backups, retaining deleted information for up to 2 months
- A PostgreSQL hot standby with manual failover
- HTTPS for client-to-server traffic and WireGuard between servers
- WebAuthn two-factor authentication documented in the open-source service
- A published Data Breach Policy with a 72-hour supervisory-authority notification when required
- A public status page
- Public BSD-licensed source code and a repository security policy
- A privacy policy covering GDPR data-subject requests and regular vulnerability monitoring
Not evidenced in the reviewed public record
- A Healthchecks.io security certification
- Encryption at rest for primary database data (the public record states it is not encrypted at rest)
- A separate disaster-recovery runbook
- A granular production-access policy
- Staff 2FA enforcement
- Customer SSO
- Staff-device controls
- A third-party penetration test
- A retention period for logs
- Cyber-liability insurance
Contact
Send the following to contact@healthchecks.io:
- security questions
- vulnerability disclosures
- data-subject requests
Website: https://healthchecks.io/
Security Questionnaire Answer Bank — Healthchecks.io
Based on public information about Healthchecks.io reviewed on 2026-10-28. Independent Trustpack demonstration; not provided or endorsed by Healthchecks.io, and not an audit or certification.
Q: Is customer data encrypted at rest?
A: According to the reviewed public sources, Healthchecks.io's primary database data is not encrypted at rest. Off-site database backups are GPG-encrypted, and subprocessors do not hold the key. The primary database runs on Hetzner bare-metal servers in Germany.
Q: Is customer data encrypted in transit?
A: Healthchecks.io uses HTTPS for client-to-server traffic. Traffic between its servers travels over WireGuard. Specific TLS protocol versions were not evidenced in the reviewed public sources.
Q: How is access to production systems and customer data controlled, and is least privilege enforced?
A: The public FAQ identifies a one-person operations team at Healthchecks.io. A more granular production-access policy was not evidenced in the reviewed public sources.
Q: Is multi-factor authentication enforced for staff and available to customers?
A: Staff 2FA enforcement was not evidenced in the reviewed public sources. Customer accounts use an email address with an optional password. The open-source Healthchecks service also documents WebAuthn two-factor authentication.
Q: How are backups and disaster recovery handled?
A: Healthchecks.io takes daily GPG-encrypted PostgreSQL backups and stores them off-site. Amazon Web Services is listed as the subprocessor for these encrypted backups. A PostgreSQL hot standby is documented, and database failover is manual. A separate disaster-recovery runbook was not evidenced in the reviewed public sources. A public status page is available at https://status.healthchecks.io/.
Q: Is there an incident-response process, and what is the breach-notification commitment?
A: Healthchecks.io publishes a Data Breach Policy. It covers reporting, containment, investigation, customer notification, remediation review, and a public incident report. Under that policy, affected customers are notified without undue delay. A supervisory authority is notified within 72 hours when required. Security questions and disclosures can be sent to contact@healthchecks.io.
Q: Which subprocessors handle customer data?
A: The reviewed public sources list five subprocessors:
- Hetzner (hosting and data storage)
- Amazon Web Services (encrypted database backups)
- Twilio (SMS and WhatsApp delivery)
- Braintree (payments)
- Fastmail (email hosting)
Customer data is held in Germany.
Q: How is customer data deleted, and what are the retention periods?
A: Customers can close their Healthchecks.io account. Inactive accounts are closed after 1 year plus a 30-day notice. The privacy policy states that deleted information may remain recoverable in database backups for up to 2 months. The privacy policy also supports GDPR requests for access, correction, deletion, processing restriction, objection, and portability. Project and check data are available through the documented API.
Q: How are vulnerabilities and dependency updates managed?
A: The security policy in the public repository directs vulnerability reports to contact@healthchecks.io. The privacy policy states that vulnerability monitoring is performed regularly. The BSD-licensed source code and change history are public at https://github.com/healthchecks/healthchecks. A third-party penetration test was not evidenced in the reviewed public sources.
Q: Is SSO offered to customers?
A: Customer SSO availability was not evidenced in the reviewed public sources. The documented sign-in method is an email address with an optional password. The open-source service also documents WebAuthn two-factor authentication.
Q: What security certifications are held?
A: No Healthchecks.io security certification was evidenced. Its hosting provider, Hetzner, states ISO 27001 certification. Controls that are publicly documented include:
- daily GPG-encrypted off-site PostgreSQL backups
- HTTPS and WireGuard for data in transit
- a published Data Breach Policy
- public source code at https://github.com/healthchecks/healthchecks
Q: Are audit or access logs kept?
A: The Healthchecks.io privacy policy documents several types of logs. These cover browser, device, server, IP-address, referral, access-time, and operating-system information. A retention period for those logs was not evidenced in the reviewed public sources.
Public-Evidence Gaps
The following items were not evidenced in the reviewed public sources. Their absence from public sources says nothing about whether they exist.
- Encryption at rest for primary database data (the sources state it is not encrypted at rest)
- Specific TLS protocol versions
- Granular production-access policy
- Staff 2FA enforcement
- Staff-device (endpoint) controls
- Separate disaster-recovery runbook
- Customer SSO availability
- Third-party penetration test
- Log retention period
- Healthchecks.io security certification
- Cyber-liability insurance
Access Control & Identity Policy
Based on public information about Healthchecks.io reviewed on 2026-10-28. Independent Trustpack demonstration; not provided or endorsed by Healthchecks.io, and not an audit or certification.
1. Scope
This document summarizes publicly available information about how access to Healthchecks.io and its customer data is controlled. Healthchecks.io is an open-source hosted service that monitors cron jobs and scheduled tasks, operated by a team of one. It covers:
- Customer accounts on the hosted service at https://healthchecks.io/
- Production systems hosted on Hetzner bare-metal servers in Germany
- Off-site database backups and the subprocessors that handle customer data
Security questions and disclosures can be sent to contact@healthchecks.io.
2. Account Provisioning and Deprovisioning
Customer accounts. Customers sign up with an account email address and may optionally set a password.
Account closure. Customers can close their own accounts. Inactive accounts are closed after 1 year, following a 30-day notice. The privacy policy states that deleted information may remain recoverable in database backups for up to 2 months after deletion.
Data-subject requests. The privacy policy supports access, correction, deletion, processing restriction, objection, and portability requests. Project and check data are also available through the documented API.
Staff accounts. A staff provisioning or deprovisioning procedure was not evidenced in the reviewed public sources. See Section 6.
3. Production Access
The public FAQ identifies a one-person operations team. No more granular production-access policy was evidenced in the reviewed public sources.
Relevant technical boundaries that are documented publicly:
- Client-to-server traffic uses HTTPS.
- Traffic between servers uses WireGuard.
- A PostgreSQL hot standby is documented, and database failover is manual.
- Primary database data is not encrypted at rest.
- Off-site database backups are GPG-encrypted, and subprocessors do not hold the decryption key.
Subprocessors with access to customer data, as listed publicly:
| Subprocessor | Function |
|---|---|
| Hetzner | Hosting and data storage |
| Amazon Web Services | Encrypted database backups |
| Twilio | SMS and WhatsApp delivery |
| Braintree | Payments |
| Fastmail | Email hosting |
4. Authentication Requirements
Customers. Accounts use an email address with an optional password. The open-source Healthchecks service documents WebAuthn two-factor authentication.
Staff. Staff 2FA enforcement was not evidenced in the reviewed public sources.
SSO. Customer SSO availability was not evidenced in the reviewed public sources.
5. Least Privilege
The reviewed public sources do not describe a formal least-privilege policy. One related control is documented: AWS stores the off-site database backups, but because the backups are GPG-encrypted and subprocessors do not hold the key, AWS stores the backups without being able to read them.
The privacy policy documents browser, device, server, IP-address, referral, access-time, and operating-system logs. A retention period for those logs was not evidenced.
The BSD-licensed source code and change history are public at https://github.com/healthchecks/healthchecks. Reviewers can inspect the authentication code there, including the WebAuthn implementation.
6. Public-Evidence Gaps
The following controls were not evidenced in the reviewed public sources. This section records only that public evidence was not found. It does not indicate whether these controls exist.
- Staff 2FA enforcement on critical systems
- Customer SSO availability
- A production-access policy more granular than the one-person operations team described in the FAQ
- A staff account provisioning or deprovisioning procedure
- Staff-device (endpoint) security controls
- A retention period for browser, server, and access logs
- A separate disaster-recovery runbook
- A third-party penetration test
- Cyber-liability insurance
Certification status: No Healthchecks.io security certification was evidenced. Its hosting provider, Hetzner, states ISO 27001 certification. This certification belongs to Hetzner, not to Healthchecks.io.
Incident Response & Breach Notification Policy
Based on public information about Healthchecks.io reviewed on 2026-10-28. Independent Trustpack demonstration; not provided or endorsed by Healthchecks.io, and not an audit or certification.
Scope
This document summarizes how Healthchecks.io, an open-source hosted service that monitors cron jobs and scheduled tasks, publicly describes its handling of security incidents and data breaches. The primary source is the published Data Breach Policy, which covers six areas: reporting, containment, investigation, customer notification, remediation review, and a public incident report. The public FAQ identifies a one-person operations team, so incident handling rests with that individual.
Customer data in scope includes account email addresses and optional passwords, billing and contact information, notification-service credentials, support messages, browser and server logs, IP addresses, device and referral data, time zones, and customer-supplied check data. This data is hosted on Hetzner bare-metal servers in Germany.
Detection and Reporting
The Data Breach Policy includes a reporting stage. The following detection and reporting inputs are evidenced publicly:
- External reports. The security policy in the public repository (https://github.com/healthchecks/healthchecks) directs vulnerability reports to contact@healthchecks.io.
- Vulnerability monitoring. The privacy policy states that Healthchecks.io performs regular vulnerability monitoring.
- Logs. The privacy policy documents browser, device, server, IP-address, referral, access-time, and operating-system logs. These logs are available as investigative records.
- Service status. Healthchecks.io publishes a public status page at https://status.healthchecks.io/.
Assessment and Investigation
The Data Breach Policy includes an investigation stage following a report. The reviewed sources do not provide additional detail on severity classification or triage criteria.
Containment
The Data Breach Policy includes a containment stage. Two transport controls limit exposure while an incident is handled. Client-to-server traffic uses HTTPS, and traffic between servers uses WireGuard.
Customer Notification Commitment
As stated in the published policy:
- Affected customers are notified without undue delay.
- A supervisory authority is notified within 72 hours when required.
Security questions and disclosures can be sent to contact@healthchecks.io.
Post-Incident Review
The Data Breach Policy includes a remediation review after an incident. It also provides for a public incident report. Because the service's source code and change history are public under a BSD license, code-level fixes are visible in the public repository.
Recovery Controls Evidenced
- Backups. Daily PostgreSQL backups are GPG-encrypted and stored off-site. Amazon Web Services holds the encrypted backups, and subprocessors do not hold the decryption key.
- Backup retention. The privacy policy says database backups may retain deleted information for up to 2 months.
- Standby database. A PostgreSQL hot standby is documented. Database failover is manual.
- Hosting provider. No Healthchecks.io security certification was evidenced. Its hosting provider, Hetzner, states ISO 27001 certification.
Public-Evidence Gaps
The following items were NOT EVIDENCED IN REVIEWED PUBLIC SOURCES. Listing them here records only the absence of public evidence. It does not indicate whether these controls exist.
- A separate disaster-recovery runbook, beyond the documented hot standby and manual failover.
- Recovery time or recovery point objectives.
- A retention period for browser, server, and access logs.
- A production-access policy more granular than the one-person operations team.
- Staff 2FA enforcement on critical systems.
- Staff-device (endpoint) security controls.
- A third-party penetration test.
- Cyber-liability insurance.
- Encryption at rest for the primary database. The intake states that primary database data is not encrypted at rest, which is relevant to breach-impact assessment.
Reviewers who need details on these items can contact Healthchecks.io directly at contact@healthchecks.io.
Data Protection & Retention Policy
Based on public information about Healthchecks.io reviewed on 2026-10-28. Independent Trustpack demonstration; not provided or endorsed by Healthchecks.io, and not an audit or certification.
Scope
This document describes how Healthchecks.io, an open-source hosted service that monitors cron jobs and scheduled tasks, handles customer data, based on its public sources. The public FAQ identifies a one-person operations team. Security questions and disclosures go to contact@healthchecks.io.
Data Categories Handled
According to its privacy policy, Healthchecks.io stores:
- Account email address and optional password
- Billing and contact information
- Notification-service credentials
- Support messages
- Browser and server logs, IP address, device and referral data
- Time zone
- Customer-supplied check data
The privacy policy documents logs covering browser, device, server, IP address, referral, access time, and operating system.
Hosting and Region
The service runs on Hetzner bare-metal servers. Customer data is held in Germany.
Encryption
In transit: Client-to-server traffic uses HTTPS. Traffic between servers uses WireGuard.
At rest: Primary database data is not encrypted at rest. Off-site database backups are GPG-encrypted, and subprocessors do not hold the decryption key.
Backups and Retention Windows
- Backups: Healthchecks.io takes daily GPG-encrypted PostgreSQL backups and stores them off-site. Amazon Web Services stores the encrypted backups.
- Backup retention: The privacy policy states that database backups may retain deleted information for up to 2 months.
- Availability: A PostgreSQL hot standby is documented. Database failover is manual.
- Inactive accounts: Inactive accounts close after 1 year, following a 30-day notice.
- Status: A public status page is available at https://status.healthchecks.io/.
Deletion and Export on Request
Deletion: Customers can close their account at any time. After deletion, the information may remain recoverable in database backups for up to 2 months.
Export: Customers can request access to their data and data portability under the privacy policy. Project and check data are also available through the documented API.
Subprocessors
| Subprocessor | Purpose |
|---|---|
| Hetzner | Hosting and data storage |
| Amazon Web Services | Encrypted database backups |
| Twilio | SMS and WhatsApp delivery |
| Braintree | Payments |
| Fastmail | Email hosting |
Certification status: No Healthchecks.io security certification was evidenced. Its hosting provider, Hetzner, states ISO 27001 certification.
GDPR Data-Subject Requests
The privacy policy supports the following data-subject requests:
- Access
- Correction
- Deletion
- Processing restriction
- Objection
- Portability
Incident and Breach Handling
The published Data Breach Policy covers:
- Reporting
- Containment
- Investigation
- Customer notification
- Remediation review
- A public incident report
Affected customers are notified without undue delay. A supervisory authority is notified within 72 hours when required.
Transparency of Code
The BSD-licensed source code and its change history are public at https://github.com/healthchecks/healthchecks. The open-source service documents WebAuthn two-factor authentication for customer accounts.
Public-Evidence Gaps
The following items were not evidenced in the reviewed public sources. This document makes no statement about whether these controls exist.
- A retention period for browser, device, server, and access logs
- A separate disaster-recovery runbook
- A production-access policy more granular than the one-person operations team
- Staff 2FA enforcement
- Customer SSO availability
- Staff-device controls
- A third-party penetration test
- Cyber-liability insurance
Reviewers who need information on these items can contact contact@healthchecks.io.