Security by Architecture, Not Afterthought

ClientSignal enforces strict data isolation at the database layer using PostgreSQL Row Level Security (RLS). Every query, mutation, and background execution must prove active organization membership and appropriate role authorization before records are returned. We maintain automated negative regression tests to verify that tenant data is never accessible across organization boundaries.

Accepting customer target domains requires rigorous defenses against Server-Side Request Forgery (SSRF). Our monitoring runners execute in isolated, ephemeral container environments that enforce:

• Pre-flight DNS resolution checking A and AAAA records against IANA special-purpose registries.
• Explicit rejection of private, loopback, link-local, carrier-grade NAT, and cloud metadata IP ranges (e.g., 169.254.169.254).
• Strict restriction to HTTP and HTTPS protocols on standard ports (80/443).
• Validation of every redirect target before following redirect chains.

We believe the safest data is data that is never stored. ClientSignal does not store client customers' personal data, passwords, or end-user submissions. Synthetic test runs use isolated synthetic parameters directed to designated test endpoints. Failure screenshots and network logs are strictly sanitized and purged according to configurable retention windows.

All content fetched from monitored websites (including page titles, meta descriptions, server headers, and error messages) is treated strictly as untrusted data. We never inject scraped HTML into the application DOM via unescaped rendering APIs.