Security and data
How Vigila handles your data
Postgres on Render, separated per workspace; Slack webhook addresses, webhook signing secrets and alert addresses encrypted at rest (AES-256-GCM).
What Vigila holds
- Status pages, components and their status history
- Incident facts, drafts, published updates and reports
- Subscribers' email addresses and webhook URLs
- HTTP check results and inbound alert payloads
- Team members' accounts
How long it’s kept, and how to export or delete it
Kept while the workspace exists; HTTP check results deleted after 30 to 365 days (90 by default); alert payloads after 180 days; demo inputs after 24 hours. Export or delete from Settings.
The full detail is in Vigila’s data export and deletion policy.
Who processes it
Service providers (subprocessors), each on our instructions and only for the purpose shown:
- Render: hosting, databases and backups, in the United States.
- Stripe: subscription and license payments (card details go to Stripe, never to us).
- Resend: sending subscription confirmations and the incident updates you publish.
- Anthropic: drafting status updates and customer emails from the facts you enter.
Questions and security reports
Vigila is run by New Odyssey. To ask what we hold about you, to have it exported or deleted, or to report a security problem, email clio@new-odyssey.com. The privacy policy covers the rest.