Security
Last updated November 1, 2026
Security is a core part of SaaSMon. We protect customer data with access controls, secure transport, and practical privacy-by-default practices. This page describes what we do today, in plain terms.
Safeguards
- Account-based data isolation: every request is scoped to the signed-in account, so one user cannot read another's records.
- Encrypted communication over HTTPS for the website, the app and the API.
- Restricted operational access and audit-minded workflows: only the people who run the service can reach production systems, and only when needed.
Sign-in and accounts
- Passwords are stored only as salted hashes, never in plain text.
- You can sign in with Google or GitHub instead of a password; we never see your password for those services.
- Email addresses are verified before an account is fully active.
- Cloudflare Turnstile protects sign-in and sign-up forms against automated abuse.
API keys
- Keys are shown in full only once, when created. We store a SHA-256 hash, so a copy of our database does not reveal usable keys.
- Each key has a scope (read-only or read-write) and can be revoked from the dashboard at any time; revoked keys stop working immediately.
- API requests are rate limited per key to protect the service.
- You are responsible for keeping your keys secret. Do not commit them to public repositories or put them in client-side code.
Payments
Payments are handled by Dodo Payments, our merchant of record. Card and payment details are entered on Dodo Payments' checkout and never pass through or get stored on SaaSMon servers.
Infrastructure and providers
- The application and database run with a cloud hosting provider.
- Uploaded images are kept in S3-compatible object storage.
- Emails are delivered through an SMTP email provider.
The full list of providers and what they process is in the Privacy Policy. We do not currently hold third-party security certifications.
Your data, your copy
You can export your transactions to CSV at any time on every plan. Keeping your own periodic export is a simple, independent backup.
Reporting a vulnerability
If you believe you have found a security issue, email [email protected] with steps to reproduce. Please give us reasonable time to fix it before disclosing publicly, and do not access other users' data or disrupt the service while testing. Our security.txt is published at /.well-known/security.txt.