Source

Security / trust page — Checkly

Checked for Checkly on 1 Nov 2026

Page: https://www.checklyhq.com/security/
Checked: 1 Nov 2026, 10:20 UTC
How we may use it: Public page, crawling permitted

Technical details

type: page
http status: 200
content hash: sha256:a2c0826153d3d4be166590fa5c73f2d97bf42e6c0d6db27f787c4cff382119d1
permission: robots_ok
screenshot: Screenshot on file (internal exhibit, not published)

Cited by

Facts read from this source

GDPR Report an error

“Is Checkly GDPR compliant? Yes, Checkly is fully compliant with GDPR.”
SOC 2 Report an error

“Is Checkly SOC 2 Compliant? Yes, Checkly is SOC 2, Type 2 compliant showing we cover security, availability, confidentiality, privacy, and processing integrity.”
Auth0 certifications Report an error

“Our authentication provider Auth0 is SOC 2 Type 2, ISO 27001, and 27018 certified.”
Aws certifications Report an error

“Our infrastructure provider AWS maintains numerous certifications, including PCI, HIPAA, ISO, and SOC compliance.”
White hat program Report an error

“We operate a white hat program that encourages developers to investigate and collaborate with Checkly on security vulnerabilities.”
Check types Report an error

“Checkly can run two types of monitoring checks: API checks, which consist of one or more HTTP requests to a user-defined API endpoint Browser checks, which run a series of user-defined interactions on a web page through a headless browser.”
No source code access Report an error

“Has no access to the monitored application’s source code.”
Providers Report an error

“On which cloud platform is Checkly running? Amazon Web Services (AWS) and Vercel.”
Data region Report an error

“All data is stored in the European Union, AWS eu-west-1 (Ireland). Only check result data may be stored at the region the user executed the check.”
Ddos protection Report an error

“Checkly uses Cloudflare to protect its network infrastructure against volumetric attacks, in addition to a dedicated DDoS mitigation service.”
Brute force protection Report an error

“Brute-force protection, which safeguards against brute-force attacks from a single IP Address and targets a single user account, is enabled by default for all connections.”
Check scripts Report an error

“Users can create and edit JavaScript-based scripts that can run automatically to perform a check on an API / UI. Environment variables holding secrets are encrypted and obfuscated.”
Stored data Report an error

“Check result data: Screenshots, HTTP response data, and execution logs.”
User credentials storage Report an error

“User Credentials are not held by Checkly but with our authentication provider Auth0.”
Payment provider Report an error

“Credit card and billing information are stored by our payment provider Stripe and on Checkly.”
Encryption Report an error

“We are encrypting stored data End-to-End. We use HTTPS for all network traffic, encrypt our queueing traffic and use state of the art AES256 encryption for data-at-rest in our database.”
Retention log data Report an error

“Detailed log data is purged after one month.”
Retention check results Report an error

“Check result data is rolled up after 1 month if not otherwise agreed with the customer, keeping only metadata.”
Log systems Report an error

“AWS data is retained for a maximum of 1 month after which it is purged. This includes logs generated by users. For Grafana Cloud — which contains application-level logs — is searchable for 1 month, and retained for 1 year.”
Account deletion Report an error

“Yes, we can erase all account data on request.”
Backup retention Report an error

“Data is continuously backed up and available for recovery up to 4 days ago.”
Backup encryption Report an error

“All backups are AES256 encrypted in an AWS S3 bucket.”
Check results storage Report an error

“Other check result data is stored redundantly on S3 and removed after 30 days.”
Disaster recovery region Report an error

“The above measures allow Checkly to fall back in the us-east-1 AWS region.”
Data isolation Report an error

“Customer data is logically split in the database per account.”
Infrastructure scaling Report an error

“All our core processing, storage, and queueing infrastructure can scale automatically when needed.”
Static web app Report an error

“Our web application and website are 100% static, using no servers or load balancers outside of a 3rd party CDN serving the static assets.”
Dependency updates Report an error

“Software control and updates are carried out daily using Dependabot; this way, we track vulnerabilities and critical updates to our production code.”
Access controls Report an error

“We use RBAC, and all IAM controls available to us on the AWS infrastructure. Only qualified personnel has access to production infra. Checkly employees don’t have physical access to the data centers.”
MFA production Report an error

“Multi-factor authentication or Two-factor auth is by default on for all access to production infrastructure.”
Admin monitoring Report an error

“The infrastructure provider tracks access to core infrastructure. Any key changes to our codebase and infrastructure follow a code review process to enforce the four-eyes principle.”
Authentication options Report an error

“By default, the user authenticates via user name and password. We support single sign-on via social logins (Google, Github). SAML 2.0 and integrations like Microsoft AD are available for Enterprise users.”
Terraform Report an error

“Terraform Provider”
Pulumi Report an error

“Pulumi Provider”
Cli Report an error

“Checkly CLI”
Status pages Report an error

“Status Pages”
Alerts Report an error

“Alerts”
AI root cause analysis Report an error

“AI Root Cause Analysis”
Traces Report an error

“Traces”
Playwright checks Report an error

“Playwright Checks”
Downtime detector Report an error

“Downtime Detector”
Heartbeat monitoring Report an error

“Heartbeat Monitoring”

Scores citing this record

The Agency Developer API, monitoring as code & team administration
The Agency Developer European sovereignty
The Customer Support Lead API, monitoring as code & team administration
The Customer Support Lead European sovereignty
The E-Commerce Operations Manager API, monitoring as code & team administration
The E-Commerce Operations Manager European sovereignty
The SaaS Platform Engineer API, monitoring as code & team administration
The SaaS Platform Engineer European sovereignty
The Information Security Officer API, monitoring as code & team administration
The Information Security Officer European sovereignty
The Skeptic API, monitoring as code & team administration
The Skeptic European sovereignty