Uptime Monitoring & Status Pages
updown.io
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Adrien Rey-Jarthon (EI) · updown.io
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
updown.io at a glance
- Vendor
- Adrien Rey-Jarthon (EI)
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates updown.io 3/5, the mean of 6 judges. updown.io is a bootstrapped uptime monitoring and status page service from Adrien Rey-Jarthon (EI), a French sole proprietorship since 2012. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
updown.io is a bootstrapped uptime monitoring and status page service from Adrien Rey-Jarthon (EI), a French sole proprietorship since 2012. Strongest are pricing transparency, from 7 to 9, and checks and locations, from 6 to 7: 1 credit = 1 check, credit packs from 5 € for 200,000 credits to 500 € for 60,000,000 credits, first 100,000 credits free, and a downtime confirmed after three down checks from at least two of ten locations. That spread reflects the status-page price, on which we found no public information. Sovereignty sits at 7 on an Article 28 data processing agreement in force for every account and a subprocessor list naming locations and safeguards, with US providers in the chain under SCCs or the EU-US Data Privacy Framework; no ISO 27001 or SOC 2 certification is documented. Weakest is automation and teams at a flat 4: accounts are single-user, team accounts in progress. Alerting and on-call and status pages, from 5 to 6, trail: escalation is an open feature request, and we found no public information on incident updates or subscriber notifications.
Speaks for it
- A downtime is confirmed only after three down checks from at least two of ten named locations, with recovery requiring the same two-location logic.
- Pricing is computable from the public pages: 1 credit = 1 check, credit packs from 5 € for 200,000 credits to 500 € for 60,000,000 credits, SMS at 7500 credits (≈ 0.10€) per message, excluding VAT, no commitment, and the first 100,000 credits free.
- An Article 28 data processing agreement is already in force for every account, with deletion or return at your choice, audit rights and 30 days' notice of subprocessor changes.
- A documented REST API covers checks, downtimes, metrics, recipients, status pages and nodes, with a read-only key and client libraries in ten languages.
- Every check keeps a ten-year performance chart and monthly and yearly uptime numbers, with weekly reports to multiple email addresses and probe IPs published for allow-listing.
Held against it
- Notification acknowledgement and escalation exist only as an open feature request, and we found no public information on phone-call alerts or on-call schedules.
- Accounts are single-user today, with the captured pages giving different signals on shared access — team accounts marked in progress, while the operator writes that permissions, audit logs and SSO are not planned in the near future.
- We found no public information on incident updates, scheduled maintenance announcements or how status page subscribers are notified.
- DNS record checks sit under review as a feature request, and we found no public information on browser or multi-step transaction checks or private in-network locations.
- The terms give no warranty on the correctness of collected data, and monthly and yearly reports remain under review, with reporting today limited to the last 24 hours and 7 days.
Best for
- You want to compute the exact monitoring cost before committing — the credit model, every pack price and the SMS rate are published, with the first 100,000 credits free.
- You need false-positive-resistant downtime alerting — a downtime is confirmed by three down checks from at least two of ten locations before you are notified.
- You need a documented GDPR chain — a French sole proprietorship under French law, an Article 28 data processing agreement in force for every account, and a subprocessor list with locations and safeguards.
- You report uptime history to clients or in contract renewals — each check carries a ten-year performance chart and monthly and yearly uptime numbers.
Avoid if
- You rely on alert acknowledgement and escalation for on-call coverage — both exist only as an open feature request on the vendor's pages.
- Your team needs multiple users, roles or SSO today — accounts are single-user, team accounts are in progress, and the operator writes that permissions, audit logs and SSO are not planned in the near future.
- You need multi-step or browser-flow checks of a checkout or login journey — the documented check types are HTTP(S), TCP, ICMP and pulse.
- You must treat uptime data as warranted evidence — the terms give no warranty on the correctness of collected data.
The scores
| Criterion | Panel median |
|---|---|
| Checks, locations & failure confirmation | 3.5 of 5 |
| Alerting, escalation & on-call | 3 of 5 |
| Status pages & incident communication | 3 of 5 |
| API, monitoring as code & team administration | 2 of 5 |
| Uptime reports, data & the vendor's own reliability | 3 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 4 of 5 |
Checks, locations & failure confirmation
Show reasoningHide reasoning
How this is scored
What can be monitored and how reliably a failure is detected: HTTP(S) with status code and keyword checks, TCP and port, ping, DNS records, SSL certificate and domain expiry, cron jobs and heartbeats, multi-step API checks with assertions, browser or transaction checks of a login or checkout, the shortest check interval, the number and regions of probe locations, the re-check from a second location before an alert, timeouts and response time thresholds, and private locations inside the customer's own network.
0 — Runs no checks of its own; a status page or alerting tool that only receives signals from other monitors.
3 — HTTP checks of a URL at a fixed interval with an up or down result; keyword, SSL, cron and the probe locations are basic or not described.
5 — HTTP(S), keyword, TCP or port, ping and SSL expiry checks, cron or heartbeat monitoring, an interval of one minute or less, several named probe locations, a failure confirmed from a second location before alerting, and response times recorded per check.
8 — Multi-step API checks with assertions on headers and body, browser or transaction checks of a user flow, DNS and domain expiry checks, sub-minute intervals, probe locations listed by city with the confirmation logic documented, private locations or agents for internal services, and maintenance windows that pause checks.
10 — Coverage and accuracy a reliability team runs on: every check type above with code-based checks (for example Playwright or scripted tests) in version control, location-specific thresholds, false-positive handling and probe health published, and the detection method documented so a result can be reproduced.
The Agency Developer
Everything I need after our certificate scare is documented: HTTP(S) with keyword, port, ping, SSL and domain-expiry checks at intervals down to 15 seconds, ten probe locations listed by city, and a failure confirmed by two extra checks from at least one different location before an alert goes out. The gap upward is real, though: DNS record checks appear only as a request under review rather than a shipped feature, and we found no public information on browser or transaction checks for a Shopware checkout or private probes inside a client's own network. 1 5 6 11 12
The SaaS Platform Engineer
Fifteen-second intervals across ten nodes named by city with every IPv4 and IPv6 address published, a minimum of two locations enforced (the operator refuses single-location checks as false-positive prone), and a downtime called only after three down checks from at least two locations with the same two-location recovery logic and a documented guarantee that any outage longer than the interval × 1.5 is notified — this is the false-positive handling I want before a page reaches my phone. Keyword, TCP, ping, SSL expiry and revocation, domain expiry and push-based cron monitoring round out the coverage, and monitoring can be paused. We found no public information on multi-step API checks with assertions, browser or transaction checks, or private locations inside my own network, and DNS record checks appear only as a request under review. 1 4 5 6 10 11 12
The Customer Support Lead
HTTP(S), keyword, TCP, ping and cron-style pulse checks run as often as every fifteen seconds from ten monitoring nodes listed by city, and the double-check that confirms a failure from a second location before an alert is sent — including the recovery logic — is published in detail, which is exactly the confirmation story I need before we tell payroll customers anything. The captured pages show DNS record checks only as a request under review, and we found no public information on multi-step API checks, browser or transaction checks, or private locations inside our own network. 1 2 5 6 11 12
The E-Commerce Operations Manager
HTTP(S), keyword, TCP, ping, SSL-expiry and domain-expiry checks at intervals down to 15 seconds from ten named probe cities, with every downtime confirmed from a second location before alerting, covers my homepage question well. What I miss for the buying journey is any browser or multi-step transaction check of a checkout flow, DNS record checks are only under review, and no private locations inside our network are documented. 1 5 6 11 12
The Information Security Officer
The detection machinery is documented in unusual detail: HTTP(S), TCP and ICMP checks plus push-based pulse monitoring with body string matching, intervals down to 15 seconds, three down checks from at least two of ten city-named probe locations before alerting, recovery needing three up checks, and every probe IP published for allow-listing. Domain expiry alerting exists; the vendor marks DNS record checks as under review, and we found no public information on multi-step, browser or private in-network checks. 1 4 5 6 11 12
The Skeptic
HTTP(S) with keyword matching, TCP and port, ping, SSL expiry and domain expiry checks, plus push-based pulse monitoring, run from fifteen-second intervals out of ten named node cities with every probe IP published for firewall allow-listing. Failure confirmation is documented to my taste: a downtime needs three failed checks from at least two locations before anyone is paged, single-location checks are refused outright as false-positive-prone, and the vendor is candid that blips shorter than the check interval go unnotified. It stops short of the top band on coverage: no multi-step or browser-flow checks are described, DNS record checks sit under review as a feature request, and we found no public information on private probes inside a customer's own network. 1 5 6 10 11 12
Alerting, escalation & on-call
Show reasoningHide reasoning
How this is scored
How the right person learns about a failure: alert channels (email, SMS, phone call, push app, Slack, Microsoft Teams, Telegram, webhooks), alerts to PagerDuty, Opsgenie or similar tools, escalation policies when an alert is not acknowledged, on-call schedules and rotations, acknowledge and resolve from the app, alert grouping and noise reduction, recovery notifications, maintenance windows that mute alerts, and whether SMS and calls are included or charged per message.
0 — No alerting at all; results can only be viewed in the dashboard.
3 — Email alerts and one or two chat integrations; escalation, phone calls and schedules are basic or not described.
5 — Email, SMS, a mobile push app, Slack, Microsoft Teams and webhooks, alerts forwarded to PagerDuty or Opsgenie, per-monitor alert contacts, recovery notifications, a delay or threshold before alerting, and maintenance windows that mute alerts.
8 — Phone call alerts, escalation policies with timeouts, on-call schedules and rotations with overrides, acknowledge and resolve from the app or chat, alert grouping, incident timelines with who did what, and the price of SMS and calls stated per country or included in the plan.
10 — On-call that replaces a separate incident tool: follow-the-sun schedules, escalation across teams, alert routing by service and severity, post-incident reviews generated from the timeline, and delivery of every alert channel monitored and reported.
The Agency Developer
Email, SMS, Slack, Teams, Telegram, webhooks and an Opsgenie integration cover the channels my team uses, SMS is priced openly at 7500 credits (≈ 0.10€) per message, and the alerting behaviour is documented in detail — recovery checks from two locations, still-down reminders, and a guarantee that any downtime longer than one and a half times the check interval is notified. Notification acknowledgement and escalation is only an open feature request, and we found no public information on phone-call alerts or on-call schedules, so an unacknowledged night alert stays with whoever first received it. 1 2 5 12 13
The SaaS Platform Engineer
Email, SMS, Slack, Microsoft Teams, Telegram, webhooks and Zapier, a completed Opsgenie integration, recovery notifications and 'still down' reminders that space out over hours, with SMS priced at "7500 credits (≈ 0.10€) per message" — the alerting behaviour is documented better than most, including what will and will not be notified. For my four-person rotation it stops at the door: acknowledgement and escalation are an open feature request proposing a fifteen-minute, parametrable timeout, and we found no public information on phone call alerts, on-call schedules, alert grouping or incident timelines. 1 2 12 13
The Customer Support Lead
Alerts go out by email, SMS, Slack, Microsoft Teams, Telegram, webhooks and Zapier with forwarding to Opsgenie, plus recovery notices, still-down reminders on an increasing delay and a pause option, and the SMS price is published at 7500 credits (≈ 0.10 €) per message rather than hidden. The captured pages show notification escalation and alert acknowledgement as an open feature request, and we found no public information on phone call alerts, on-call schedules or a mobile push app. 1 2 12 13
The E-Commerce Operations Manager
Email, SMS, Slack, Teams, Telegram, webhooks and a completed Opsgenie integration, per-monitor recipients, recovery notices and a guaranteed notification window — the SMS at roughly 0.10 € per message is the 3 a.m. channel I need. But there is no phone call alert, no acknowledge button and no escalation policy, escalation being only an open feature request, so if the person on duty sleeps through the SMS nobody else is called. 1 2 5 12 13
The Information Security Officer
Channels are broad — email, SMS, Slack, Microsoft Teams, Telegram, webhooks, Zapier and OpsGenie — with per-monitor recipients, recovery events, documented "still down" reminders and SMS priced at 7500 credits (≈ 0.10€) per message. Escalation and alert acknowledgement are explicitly an open feature request, and we found no public information on phone calls, on-call schedules or incident timelines. 1 2 6 12 13
The Skeptic
Email, SMS, Slack, Teams, Telegram, webhooks and Zapier are documented, an Opsgenie integration appears as completed, recovery notices exist, still-down reminders deliberately skip SMS to spare the bill, and SMS is priced per message at 7500 credits (≈ 0.10€) rather than hidden behind a fair-use clause. But escalation and acknowledgement of alerts are, on the vendor's own pages, an open feature request — no escalation timeouts, no on-call schedules or rotations — and we found no public information on phone-call alerts or a mobile push app. 1 2 5 12 13
Status pages & incident communication
Show reasoningHide reasoning
How this is scored
How customers and colleagues are told: public status pages on a custom domain with SSL, components and component groups fed automatically by monitors or set by hand, incident updates and scheduled maintenance announcements, subscribers notified by email, SMS, RSS or webhook, uptime history shown per component, private or password-protected pages for internal teams or single customers, branding and custom CSS, several languages, page templates, and how the status page itself stays online when the main product is down.
0 — No status page of any kind.
3 — A public status page listing monitors with their current state; custom domain, incident updates and subscribers are basic or not described.
5 — Public status pages on a custom domain, components linked to monitors, incident updates and scheduled maintenance, email subscribers, uptime history per component, the vendor's branding removable, and a password-protected or private page option.
8 — Component groups, SMS, RSS and webhook subscribers with per-component subscriptions, private pages with single sign-on or IP restriction, several languages, incident templates, embeddable status widgets, audience-specific pages for single customers, and the status page hosting kept separate from the main service and documented.
10 — Incident communication end to end: incidents drafted from monitor events and approved by a person, updates published to the page, subscribers, chat and social channels at once, a full incident archive with post-mortems, status page uptime published, and accessibility of the page stated.
The Agency Developer
A public status page with several checks, my own subdomain via a CNAME, white-label branding, a localized page, and public, protected or private visibility with a generated access key maps well onto one status page per client, and the ten-year history chart per check is strong. We found no public information on incident updates and scheduled-maintenance announcements, and the subscriber story is thin beyond a page about letting customers subscribe — which matters when a client's shop is down and their customers need telling. 2 5 14 18
The SaaS Platform Engineer
Status pages run under our own subdomain with a simple CNAME and SSL, can be public, protected by an access key or private, are white-labelled, localized, and carry a ten-year history chart fed by the checks. What I need at 3 a.m. is where the captured pages go quiet: we found no public information on posting incident updates or scheduled maintenance announcements, nor on notifying subscribers by email, SMS, RSS or webhook. 2 5 14 18
The Customer Support Lead
Status pages run on our own domain through a CNAME, can be public, protected with a random access key or fully private for the largest accounts, with white-label branding, several languages and a ten-year history chart I can point to in a contract renewal. We found no public information on incident templates or scheduled maintenance announcements, and although a feature page exists for letting customers subscribe, the captured material does not state how or whether subscribers are notified — the gap I would feel hardest during the next three-hundred-ticket outage. 2 5 14 15 18
The E-Commerce Operations Manager
A status page on our own subdomain with SSL, white-label branding, logo customisation, public/protected/private visibility, localisation and a ten-year history chart is more than I expected. We found no public information on incident update templates, scheduled maintenance announcements, or the channels subscribers are notified through, so the communication half during a checkout outage stays unproven. 2 3 5 14 18
The Information Security Officer
Pages run on a custom subdomain via CNAME with SSL, can be public, key-protected or private, are white-label and localised, and carry a ten-year history chart. We found no public information on components, incident updates, scheduled maintenance announcements or subscriber notifications on these pages. 2 5 6 14 18
The Skeptic
Public pages with a custom domain via CNAME, three visibility modes including a key- or password-protected option, white-label branding, design customization, localization and a ten-year history chart are all documented. What I could not find is the incident half of the story: we found no public information on incident updates, scheduled maintenance announcements, how subscribers are notified, or how the status page itself stays up when the main service is down. 2 3 5 14 18
API, monitoring as code & team administration
Show reasoningHide reasoning
How this is scored
How the tool fits a team and a deployment pipeline: a documented REST API to create and read monitors, status pages and incidents, a Terraform provider, CLI or monitoring-as-code workflow, checks run from CI/CD before a deploy, bulk import of monitors, integrations with ticketing and chat tools, team members with roles, single sign-on (SAML) and SCIM, audit logs, several teams or client accounts in one organisation, white-label or client reporting for agencies, and two-factor authentication.
0 — No API, no team accounts; one login per account and monitors are set up only by hand.
3 — A web dashboard with a few team members; the API, roles and multi-client set-up are basic or not described.
5 — A documented REST API covering monitors and status pages, webhooks, team members with roles, two-factor authentication, bulk import or a CSV upload of monitors, and several projects, teams or client groups in one account.
8 — A Terraform provider or monitoring-as-code CLI with checks kept in version control, checks triggered from CI/CD, single sign-on (SAML), SCIM provisioning, audit logs, sub-accounts for clients with their own logins, and white-label client reports.
10 — Administration that scales across many teams and clients: every setting reachable by API and code with parity stated, granular roles per resource, SSO enforced with SCIM, audit logs exportable to a SIEM, and agency or reseller accounts with separate billing.
The Agency Developer
The REST API is genuinely good — checks, recipients, status pages and nodes, plus webhooks, a read-only key, community libraries and Zapier — enough to script our sixty sites. But multiple users per account is not possible today, team accounts are marked in progress, multiple API keys is an open request, and we found no public information on bulk import, two-factor authentication or SAML, so an agency like mine would run everything from a single shared login. 1 5 16 17
The SaaS Platform Engineer
The REST API is real and documented — checks, downtimes, metrics, recipients, status pages and the node list, with a read-only key and community clients in ten languages — but there is no monitoring-as-code story: no Terraform provider or CLI documented, so checks cannot live in version control next to the service they test. Team accounts are in progress with basic roles planned (full-access, read-only, billing) while the operator writes that permissions, audit logs and SSO are not planned in the near future, multiple API keys remain an open request, and we found no public information on single sign-on, SCIM, two-factor authentication or bulk import of monitors. 2 5 16 17
The Customer Support Lead
The REST API is the strong part, covering checks, metrics, recipients and status pages with webhooks, client libraries in many languages, a read-only key and API key revocation. But the captured pages state that multiple users per account are not supported, with a basic shared-access implementation described as in progress, and we found no public information on single sign-on, two-factor authentication, audit logs, bulk import, or a Terraform or command-line workflow — my nine people would be sharing one login today. 2 5 16 17
The E-Commerce Operations Manager
The REST API is genuinely good — monitors, downtimes, metrics, recipients and status pages over documented endpoints, plus webhooks, read-only keys and client libraries in ten languages. Team accounts with roles are only in progress, multiple API keys remain an open request, and we found no public information on Terraform, CI/CD checks, bulk import, SSO or audit logs, which leaves one login for the shop and one for the agency. 2 5 16 17
The Information Security Officer
The REST API is strong — checks, recipients, status pages, nodes, downtimes and metrics, with webhooks, read-only keys and key revocation — but the vendor states accounts are single-user today with team sharing and roles only in progress, and names permissions, audit logs and single sign-on as unplanned. For a NIS2 company working towards ISO 27001 that is the decisive gap: we found no public information on two-factor authentication, SCIM, audit logging or a Terraform provider. 2 5 16 17
The Skeptic
The REST API carries this criterion: checks, downtimes, metrics, recipients and status pages are all reachable, with read-only keys for public dashboards, webhooks retried up to 25 times across several days, and client libraries in ten languages. The team side is single-login today — the captured pages give different signals on shared access, with multiple users described as not planned for the near future in one place and team accounts marked in progress with basic roles in another — and multiple API keys remain an open request; we found no public information on single sign-on, SCIM, audit logs, bulk import or a monitoring-as-code workflow. 2 5 16 17
Uptime reports, data & the vendor's own reliability
Show reasoningHide reasoning
How this is scored
What the record is worth and whether the monitor itself can be trusted: uptime and SLA reports per monitor and period, response time charts and percentiles, scheduled reports by email, client-facing reports, how long check results and incident history are kept, export of results by CSV or API, the vendor's own public status page and incident history, its SLA, the probe IP addresses and user agent published for allow-listing, and an open-source or self-hosted edition.
0 — No history of any kind; only the current state is shown.
3 — An uptime percentage and a response time chart per monitor; retention, export and the vendor's own status are basic or not described.
5 — Uptime and response time reports per monitor and period, SLA reports, scheduled email reports, the retention period of check results stated, CSV or API export, the probe IPs published, and the vendor's own public status page.
8 — Response time percentiles and breakdowns (DNS, connect, TLS, first byte), client-ready branded reports, retention of a year or more stated per plan, a raw export of check results, the vendor's incident history and post-mortems public, and an SLA with credits published.
10 — A record that holds up in an audit: SLA calculations with their method stated, incident records suitable for ISO 27001, NIS2 or DORA evidence, full history exportable in an open format, a self-hosted or open-source edition with feature parity stated, and the vendor's own availability over several years published.
The Agency Developer
There is a lot I could hand a client: a monthly and yearly SLA uptime table per check, a ten-year performance chart with per-location timings, a detailed latency export, published probe IPs for allow-listing, a linked system-status page and clearly stated retention rules. But monthly and yearly scheduled reports are still under review with current reporting limited to the last 24 hours and 7 days (a weekly email report to multiple addresses exists), and we found no public information on the vendor's own incident history, post-mortems or an SLA with credits — the terms in fact give no warranty on data correctness. 2 6 8 18 19
The SaaS Platform Engineer
A monthly and yearly uptime table per check, a ten-year performance chart, per-location timings through the metrics API, a weekly report to multiple email addresses, detailed latency export, and every probe IP published under ips.updown.io for firewall allow-listing — the record is deep and retention is stated in detail (metrics compacted from hourly to monthly, downtime detail dropped after three years), with the vendor keeping a System Status page. Monthly and yearly overview reports are still under review, leaving 24-hour and 7-day periods today, and we found no public information on response-time percentiles, an SLA with credits, or the vendor's incident post-mortems; the terms also give no warranty on the correctness of collected data. 2 5 6 7 18 19
The Customer Support Lead
Every check carries monthly and yearly SLA uptime numbers since it was created plus a ten-year performance chart, detailed latency history can be exported, per-location timings come from the metrics API, the probe IPs are published for allow-listing, and the vendor runs its own system-status page — enough substance for a renewal conversation. Monthly and yearly reports are shown as under review with only last-24-hour and 7-day reports today, and we found no public information on response-time percentiles, an SLA with credits, or public post-mortems. 2 5 6 18 19
The E-Commerce Operations Manager
An SLA-style uptime table with monthly and yearly numbers per check, a ten-year performance chart, latency export, weekly reports to multiple addresses, published probe IPs for our firewall allow-list, written retention rules and the vendor's own system status page. Monthly and yearly uptime reports are only under review (currently 24-hour and 7-day views), and we found no public information on response-time percentiles, a published SLA with credits, or the vendor's incident history — the terms even give no warranty on the correctness of the data. 2 6 7 18 19
The Information Security Officer
Per-check history is genuinely long — ten-year charts, monthly and yearly SLA figures on the check page, weekly email reports, export by API, published probe IPs — with retention rules stated in the privacy policy. We found no public information on percentiles, post-mortems or an SLA with credits, and the terms disclaim any warranty on the correctness of collected data, which weakens its value as audit evidence. 2 6 7 8 18 19
The Skeptic
There is a real record here: an uptime/downtime log, monthly and yearly SLA uptime numbers per check on a private details page, weekly scheduled reports, per-location latency timings, an export of detailed latency history marked done, probe IPs published under ips.updown.io, and a System Status page of the vendor's own. Retention is stated honestly — metrics aggregated from hourly to monthly as they age, downtime diagnostics deleted after three years — but report periods today stop at 24 hours and 7 days with monthly and yearly reports still under review, and we found no public information on percentiles, the vendor's own incident history or post-mortems, or an SLA with credits; the terms cap liability at what you paid and give no warranty on the correctness of collected data. 2 6 7 8 18 19
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, alert contacts (names and phone numbers of the people on call), status page subscribers and check results are stored and processed, and who the subprocessors are (hosting, SMS and phone gateways, email delivery, support and payment tools). Independently sourced by the sovereignty pipeline. Probe locations outside Europe are part of what the product does and are not counted against it; where the data is stored and who processes it is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (SMS and call gateways, email, support, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Agency Developer
This is a real European chain, unusually well documented for a one-person vendor: a French sole proprietorship under French law, hosting named on OVH in France and Hetzner in Germany, a sub-processor list with locations for email, SMS, payments and monitoring, and an Article 28 DPA already in force with SCCs, breach notification and audit rights. It sits below the top because no ISO 27001 or SOC 2 certification is stated and parts of the chain (Postmark, Vonage, Twilio, DigitalOcean) run through US providers, each with SCCs or the Data Privacy Framework stated. 7 8 9
The SaaS Platform Engineer
A French sole proprietorship under French law with the CNIL named as the supervisory authority, hosting on OVH in France and Hetzner in Germany, and a published sub-processor list with locations and safeguards — SCCs or the EU-US Data Privacy Framework for the US links (DigitalOcean, Vonage, Twilio, Postmark) alongside EU providers (SMSalert.mobi in Romania, MailerSend in Belgium, Stripe in Ireland, PayPal in Luxembourg, CoinGate in Lithuania). An Article 28 data processing agreement is in force for every account with deletion or return at my choice, audit rights and 30 days' notice of sub-processor changes with a right to terminate for a pro-rata refund. No ISO 27001 or SOC 2 certification is documented, which keeps it off the top step. 7 8 9
The Customer Support Lead
The contracting entity is a French sole proprietorship under French law with a data processing agreement already in force for every account, and the published sub-processor list names a location and safeguard for every link — OVH France and Hetzner Germany for hosting, Standard Contractual Clauses or Data Privacy Framework safeguards on the US email, SMS and hosting providers, and a stated basis for the South African monitoring node. The storage chain still includes a US host under stated safeguards rather than European infrastructure end to end, and we found no public information on ISO 27001 or SOC 2 certifications. 7 8 9
The E-Commerce Operations Manager
A French sole proprietor under French law with a published Article 28 data processing agreement already in force for every account, hosting named on OVH in France and Hetzner in Germany, and a subprocessor list with locations and safeguards — email via MailerSend in Belgium, SMS via SMSalert.mobi in Romania, payments via Stripe in Ireland. Parts of the chain still run through US providers under Standard Contractual Clauses or the Data Privacy Framework, and no ISO 27001 or SOC 2 certification is stated, so it is not sovereign end to end. 7 8 9
The Information Security Officer
A French sole proprietorship under French law with the CNIL named, and a subprocessor list giving location and safeguard for every link: OVH France and Hetzner Germany (with DigitalOcean US under the Data Privacy Framework and SCCs) for hosting, Twilio and Vonage US alongside SMSalert.mobi Romania for SMS, Postmark US alongside MailerSend Belgium for email, and EU payment processors. A published Article 28 data processing agreement is already in force, with SCC module 3, breach notification, 30-day subprocessor change notice with a right to object, and audit rights; we found no public information on ISO 27001 or SOC 2 certification, which is what holds this below the top band. 7 8 9
The Skeptic
The chain is unusually visible: a French sole proprietorship under French law, a DPA already in force without a signature, and every subprocessor named with a location and a transfer safeguard — hosting on OVH in France and Hetzner in Germany beside a US provider under the Data Privacy Framework and SCCs, SMS gateways in the US and Romania, email in the US and Belgium, payments in Ireland, Luxembourg and Lithuania. What keeps it off the top band: we found no public information on ISO 27001 or SOC 2 certification, and only some parts of the source code are open, with no self-hosted edition described. 7 8 9
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by number of monitors, check interval and status pages, team seats and on-call responders, what SMS and phone alerts cost, which features (multi-step or browser checks, SSO, longer retention, private locations, white-label) cost extra, the free tier and its limits, overage handling, minimum term and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with monitors, intervals, seats or alerts is unclear.
5 — Tiers are public with their monitor count, interval and main inclusions, but at least one commonly needed piece (SMS or call alerts, extra seats, extra status pages, SSO, longer retention) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (monitors, interval, seats, responders, status pages), SMS and call costs stated, add-ons priced, overage handling stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of monitors, interval, team size and alert volume, with every add-on, overage and support fee and the cancellation and data-return terms published.
The Agency Developer
Cost is computable from the public pages: one credit equals one check, price scales linearly with the check interval, credit packs from 5 € to 500 € are listed, SMS costs 7500 credits (≈ 0.10€) per message, prices exclude VAT, there is no commitment and no automatic charging, and the first 100,000 credits are free — I can work out what 200 monitors would cost me without a sales call. We found no public information on whether status pages, white-label options or responders carry a separate price, which is the one thing I would want spelled out before signing sixty client sites over. 1 4 7
The SaaS Platform Engineer
Pricing is close to fully computable: 1 credit = 1 check, intervals from 15 seconds to 1 hour with linear scaling, credit packs listed from 5 € for 200,000 credits to 500 € for 60,000,000 credits, a worked example ("check 10 websites every 2 minutes from 1.83 €/month (up to 5.49 €/m)"), SMS alerts at "7500 credits (≈ 0.10€) per message", pulse checks at 1 credit per request and 1 credit per missed pulse, prices stated as "Excluding VAT", no commitment, no automatic charging without my consent, refunds by email, and the first 100,000 credits free. The remaining gaps are small: we found no public information on pricing for add-ons such as white-label status pages, or on what happens when prepaid credits run out. 1 4 7
The Customer Support Lead
The credit model is unusually computable from public pages: packs run from 200,000 credits at 5 € up to 60 million at 500 €, the homepage states ten websites checked every two minutes from 1.83 €/month (up to 5.49 €/m), SMS alerts cost 7500 credits (≈ 0.10 €) per message, prices are shown excluding VAT, there is no commitment, no automatic charging, and the first 100,000 credits are free. We found no public information on a separate price for status pages or on what happens when credits run out — the one gap in an otherwise derivable annual cost. 1 4 7
The E-Commerce Operations Manager
One credit equals one check, pricing scales linearly from 15-second to hourly intervals, every credit pack from 5 € to 500 € is listed, the first 100,000 credits are free, SMS costs 7500 credits (about 0.10 €) per message, VAT is excluded, and there is no commitment and no automatic charge — I can compute the annual cost of watching the checkout at 30-second intervals to the cent. The captured pages do not show a price for status pages or seats, so the total is computable for the monitoring itself only. 1 4 7
The Information Security Officer
The prepaid credit model is unusually computable: 1 credit = 1 check, pricing that scales linearly with interval, six credit packs from 5 € to 500 €, a worked example of ten websites every two minutes from 1.83 €/month, SMS at 7500 credits (≈ 0.10€) per message, VAT stated as excluded, no commitment, and 100,000 free starting credits. We found no public information on status page or add-on pricing. 1 4 7
The Skeptic
Unusually computable for the core service: one credit equals one check, pricing scales linearly with the interval, six credit packs run from 5 € for 200,000 to 500 € for 60,000,000, SMS costs 7500 credits (≈ 0.10€) per message, pulse edge cases are priced down to telling you a disabled check still consumes credits, VAT is excluded and stated as such, and there is no commitment, no automatic charging, and refunds by email. The hole is the status page: we found no public information on what it costs, so the real annual price of a monitoring-plus-page set-up cannot be computed from the public pages alone. 1 4 7
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about updown.io
Is updown.io European?
Yes. whats-best.ai classifies updown.io as EU-Made.
Where does updown.io store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does updown.io have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to updown.io?
As of 2 Nov 2026, the panel rates Hyperping (3.5/5), Checkly (3.5/5) and openstatus (3.5/5) highest among the other 14 Uptime Monitoring & Status Pages products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Hyperping (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: updown.io alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting location, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 8 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (with pricing) updown.io Checked 1 Nov 2026 Details →
- 2 Features page updown.io Checked 1 Nov 2026 Details →
- 3 Documentation updown.io Checked 1 Nov 2026 Details →
- 4 Documentation (cron monitoring) updown.io Checked 1 Nov 2026 Details →
- 5 API documentation updown.io Checked 1 Nov 2026 Details →
- 6 About page (monitoring nodes) updown.io Checked 1 Nov 2026 Details →
- 7 Terms of service (names the operator) updown.io Checked 1 Nov 2026 Details →
- 8 Privacy policy (with subprocessors) updown.io Checked 1 Nov 2026 Details →
- 9 Data processing agreement (dpa) updown.io Checked 1 Nov 2026 Details →
- 10 Checks, locations & failure confirmation — found from sitemap updown.io Checked 1 Nov 2026 Details →
- 11 Checks, locations & failure confirmation — found from sitemap updown.io Checked 1 Nov 2026 Details →
- 12 Alerting, escalation & on-call — found from sitemap updown.io Checked 1 Nov 2026 Details →
- 13 Alerting, escalation & on-call — found from sitemap updown.io Checked 1 Nov 2026 Details →
- 14 Status pages & incident communication — found from sitemap updown.io Checked 1 Nov 2026 Details →
- 15 Status pages & incident communication — found from sitemap updown.io Checked 1 Nov 2026 Details →
- 16 API, monitoring as code & team administration — found from sitemap updown.io Checked 1 Nov 2026 Details →
- 17 API, monitoring as code & team administration — found from sitemap updown.io Checked 1 Nov 2026 Details →
- 18 Uptime reports, data & the vendor's own reliability — found from sitemap updown.io Checked 1 Nov 2026 Details →
- 19 Uptime reports, data & the vendor's own reliability — found from sitemap updown.io Checked 1 Nov 2026 Details →