Privacy

The short version

• We store what is needed to monitor your sites and to tell you when something changed. Nothing is sold, and nothing is used to build an advertising profile.
• Traffic and security records about your visitors are collected on your instruction and belong to you. You decide how long they are kept and whether addresses are stored in full.
• Everything with a retention period is deleted automatically by a nightly job. There is no archive behind it.

1. Who is responsible for what

There are two different kinds of personal data here and they are treated differently.

Your account. The people in your company who sign in — their names, email addresses and sign-in history — are data we hold for our own purposes: operating the service, securing it, and contacting you about it. We decide how that is handled.

Your visitors. When you install the agent on a site, it reports requests made to that site: addresses, paths, user agents, referrers. That data is about your visitors, collected because you asked us to collect it. You decide what happens to it; we process it on your behalf and do not use it for anything other than showing it back to you and running the checks you configured.

2. What we store

About your account

• Your name, email address, role, timezone and notification preferences.
• A hash of your password — never the password itself.
• Two-factor secrets and passkey public keys, encrypted at rest.
• Sign-in history: time, IP address, browser and platform, and which method was used. This is what makes "someone signed in from an unfamiliar place" answerable.
• An audit log of changes made in the console — who changed what, and when.

About the sites you monitor

• The address, its configuration, and the results of every check: status code, timing breakdown, resolved address, certificate details, DNS records, response headers.
• Where an agent is installed: server metrics (CPU, memory, disk, load), the software inventory, and file hashes used for integrity comparison.
• Incidents, alerts and the notifications sent about them.

About your visitors

• For each request: time, IP address, country, method, path, query string, status code, bytes, response time, referrer and user agent.
• A session key derived from the request, so repeat visits can be counted without setting a cookie of our own.
• For blocked or suspicious requests: the rule that matched and a short excerpt of the payload, which may contain whatever the attacker submitted.

We do not read your database, your files' contents, your customers' form submissions or your email. File integrity works on hashes; an excerpt is stored only for a file the scanner flags as suspicious, so that you can see why.

3. Visitor IP addresses

An IP address is personal data in most of the world, and a monitoring product that pretended otherwise would be lying to you. Three things are worth knowing.

They are stored in full by default, because tracing an attack, blocking a source or explaining a traffic spike all need the real address.

You can turn that off. With IP masking enabled in your company settings, the last octet of an IPv4 address (or everything after the fourth group of an IPv6 address) is replaced before the record is shown. Two visitors remain distinguishable; neither is identifiable.

The real address is recovered from behind proxies. If your site is behind a CDN, the agent works out the original client address rather than recording the edge server's. That is the point of the feature, and it means the address stored is the visitor's.

4. How long it is kept

A nightly job deletes anything past its retention period. These are the defaults; your company's own retention setting overrides the ones marked with an asterisk.

Aggregated figures — hourly and daily totals, uptime percentages — outlive the individual records they were computed from. They contain no addresses and no user agents.

Deleting a site removes it from your console immediately and its data is purged on the next nightly run. Closing your account removes the account and everything under it.

5. Where it is processed

The platform runs on servers operated for this service. Checks are made from the platform's own network to the addresses you configure — which means the operator of each site you monitor will see our probe in their logs, identified by the user agent ServerPulse/1.0 (+https://serverpulse.dxcslabs.com/agent).

Some checks necessarily involve third parties: public DNS resolution, the blacklist providers configured for reputation checks, and the published IP-range feeds used to identify CDNs. These receive the hostname or address being checked and nothing else.

6. Cookies

The console sets a session cookie so you stay signed in, and a remember cookie if you ask it to. Your theme preference is kept in your browser's local storage and never sent to us. There are no analytics or advertising cookies on this site.

The agent installed on your site does not set cookies on your visitors. Sessions are counted using a key derived from request properties, which is why the visitor counts are approximate and why they need no consent banner of their own.

7. Your choices

• Export or delete any monitored site from its settings page.
• Turn on IP masking for your whole company in company settings.
• Change your retention period, or ask us to.
• Ask for a copy of the data held about your account, or for it to be deleted, by emailing us.

Requests about a visitor's data should go to the site operator — that is you, not us. If you need our help fulfilling one, ask and we will help you find and remove the records.

8. Security

• Everything travels over HTTPS. Agent reports are signed with a per-site secret and rejected if the signature, timestamp or nonce does not check out.
• Agent secrets, two-factor secrets and stored credentials are encrypted at rest.
• Passwords are hashed. Two-factor authentication and passkeys are available on every account, and a company owner can require them.
• Each company's data is scoped to that company at every query. Nobody outside your company can see your sites.

If you find a security problem, email support@dxcslabs.com and we will take it seriously.

9. Changes to this page

If what we collect or how long we keep it changes, this page changes with it and the date at the top moves. Material changes are emailed to company owners.

Contact

DxCS Labs — support@dxcslabs.com. Tell us which company you are writing about and we will answer.