Enterprise Trust & Infrastructure Safety
Security built for the systems
you cannot afford to lose.
Observability requires deep trust. We protect your monitoring configurations, probe tokens, and telemetry data with world-class engineering discipline.
How we protect your signal
Encryption Everywhere
TLS 1.3 enforced for all in-transit communications with HSTS preloading. All telemetry, audit trails, and customer configurations are encrypted at rest using AES-256.
Isolated Edge Probes
Synthetic probe nodes execute in stateless, ephemeral sandboxes. Probes never share memory or network sockets across customer workloads.
Zero-Trust Architecture
Internal employee access relies on hardware-backed MFA (FIDO2/WebAuthn), least-privilege role boundaries, and continuous posture verification.
Audit Logging & Immutability
Critical workspace actions (monitor creation, alert modifications, API key issuance) generate immutable audit logs available for security reviews.
DDoS Mitigation
Protected by Cloudflare's global anycast network capable of mitigating terabit-scale L3/L4/L7 volumetric attacks without service degradation.
Vulnerability Management
Automated real-time dependency CVE scanning, continuous static code analysis (SAST), and recurring third-party gray-box penetration tests.
Architecture & Edge Probe Isolation
When Evergreen dispatches synthetic requests from its edge probe fleet, security isolation is enforced at every layer:
Probes execute with strict timeout ceilings (maximum 30s) and
enforced egress filters preventing local loopback (127.0.0.1), cloud metadata addresses (169.254.169.254), or
private RFC 1918 subnets unless explicitly enabled via dedicated
private tunnel agents.
Sensitive authorization headers (e.g. Bearer tokens)
configured for authenticated synthetic checks are encrypted via
envelope encryption using keys stored in Cloudflare Secrets before
persistence. Raw keys are never logged in plaintext probe output.
Monitoring checks run across independent regional nodes (North America, Europe, South America, Asia-Pacific). An outage or compromise in a single availability zone cannot impair probe execution or trigger false positive alerts.
Verification & Standards
Compliance controls & governance
We maintain stringent internal controls aligned with modern industry benchmarks to safeguard your organizational data.
- SOC 2 Type II Alignment & Controls
- GDPR & UK Data Protection Act Compliant
- LGPD (Lei Geral de Proteção de Dados) Ready
- PCI-DSS Level 1 Processor (via Stripe)
- Automated daily encrypted off-site backups
- Strict TLS 1.3 & Forward Secrecy Enforced
Found a vulnerability? We want to hear from you.
We value the security research community. If you believe you have discovered a vulnerability in Evergreen, please disclose it to us responsibly. We commit to investigating, confirming, and resolving verified reports promptly.
We ask you to:
- Submit reports directly to security@evergreen.watch with detailed reproduction steps;
- Provide us reasonable time to resolve the issue before publishing or sharing findings publicly;
- Make a good-faith effort to avoid privacy violations, destruction of customer data, and interruption of our service;
- Do not attempt social engineering, phishing, or physical attacks against Evergreen employees.
Our commitment:
- Acknowledge receipt of your report within 24 business hours;
- Provide an estimated timeline for triage and remediation;
- Public credit on our Security Hall of Fame (if desired);
- We will not pursue legal action against researchers who adhere to these responsible disclosure terms.
4A9F 81BC E622 D197 0048 56EB 3391 F702 BE12 99A4 Encrypt critical findings with our PGP key or send directly via security@evergreen.watch.