Trust center
What Drumbeats actually does about authentication, secrets, and public data today, and what it deliberately does not claim.
This page describes what the product does, not certifications it does not hold. For a security review or questionnaire, use the security contact at the bottom.
Treat a ping URL as a secret#
https://api.drumbeats.io/v1/ping/<monitor-id>/successhttps://api.drumbeats.io/v1/ping/<monitor-id>/successThe Ping API has no authentication header. The monitor UUID in the URL is the credential. Anyone holding that URL can send pings to your monitor, including a success that would mask a real outage.
How you sign in#
Email and password, with email verification and password reset. You can add TOTP two-factor on your own account, and a project can require it of everyone who has access.
Scripts and integrations authenticate with an API key in the X-API-Key header instead. There are two kinds, and the difference is blast radius:
| Key type | Reaches | Risk if leaked |
|---|---|---|
| Project-scoped | One project, at the creator's role | Bounded to that project |
| Account-scoped | Every project the creating user owns | Everything that user owns |
Account-scoped keys carry an explicit permission set drawn from read, manage_monitors, manage_projects, manage_notifications, and destroy. Both types cap at three active keys per user, counted separately, and expire between 1 and 365 days.
Prefer the narrowest key that does the job. An account-scoped key handed to a third-party tool exposes every project you own, not one. This is the key type the AI agent integration uses, so mint it read-only unless the agent genuinely needs to change things.
Access control#
Four project roles, OWNER, MANAGER, MEMBER, and READONLY, described in workspace setup. A project that requires two-factor blocks anyone who has not enrolled until they do.
Review who holds MANAGER or OWNER on production projects. Those roles can change where alerts go, which is a quiet way to lose alerting entirely.
Payload handling#
Payloads are visible to every member of the project that owns the monitor, and previews appear in alert messages.
Payloads up to 10 KiB live in the primary database. Larger ones keep the first 10 KiB there and the rest in object storage. Anything over your plan limit is truncated at write time and the excess is discarded permanently. See payloads.
Public status pages#
Status pages are public when enabled, by design. The controls are per-page enablement, an optional display name and description, optional incident-history visibility, an optional noindex hint, and vanity slug routing on paid plans.
noindex asks crawlers not to list the page. It does not restrict access, and anyone with the URL can still read it. If a page should not be public, unpublish it.
Channel credentials#
Notification channels hold operationally sensitive destinations: recipient lists, Slack and Discord targets, Telegram connections, and webhook endpoints with their own auth headers.
Credentials are stored encrypted and are never returned by the notification channels API. Creating or modifying a channel requires MANAGER or higher.
What this page does not claim#
No certifications or compliance programs are claimed here, because none are currently in place. If you need a customer security review or a discussion of deployment expectations, contact the team.
Report a security issue#
Email support@drumbeats.io with Security in the subject line. Reports are acknowledged promptly and disclosure timing is coordinated with you.
Next#
Workspace setup for roles and TOTP enforcement. REST API for key scopes and the two permission gates. Payloads for what gets stored and where.