Security & Trust
Secure by design. Trusted by teams that can't afford to miss a change.
ChangeTower monitors the pages you choose and keeps what it finds encrypted, private and only ever visible to your team. That is the whole job, and we take it seriously.
- Hosted on AWS in the US
- Encrypted in transit and at rest
- 2FA and SAML SSO
- Backed up continuously
Security layered into every check we run.
Strong, layered protection runs through everything we build, from the pages you monitor to the snapshots we keep, so your team can trust what ChangeTower reports.
Your pages, and only your pages
We monitor exactly what you point us at. No crawling your systems, no access to your network, nothing collected beyond what the monitors you set up need.
Encrypted end to end
Every connection to ChangeTower is secured, and your snapshots, settings and backups are encrypted at rest. Credentials you supply for pages behind a login are encrypted too.
Least-privilege access
Production access is limited to a small number of named senior engineers, each authorized individually and reviewed regularly. Your team controls its own users, roles and permissions.
Protected at the edge
A web application firewall, DDoS protection and bot mitigation sit in front of the platform, with continuous threat detection and regular vulnerability scanning behind it.
Built to stay up
Databases are backed up continuously and the environment is deliberately overprovisioned, so spikes and partial failures are absorbed without your monitors noticing. Recovery plans are tested every year.
Ready for your review
We complete security questionnaires, sign NDAs and data processing agreements, and can provision a dedicated single-tenant environment for Enterprise customers.
What runs around the clock
Extensive controls run across the platform, the network and the team behind it, from application security and encryption to incident response and vendor reviews. Your reviewers can see the full set on request.
Application
- Web application firewall
- Monthly vulnerability scans
- Dependency vulnerability monitoring
- Code review and release approval
- Secure development lifecycle
- Separate dev, test and production
Data
- Encryption at rest
- TLS in transit
- Managed key management
- Continuous backups with point-in-time recovery
- Encrypted backups (AES-256)
- Retention and secure deletion policy
Infrastructure
- US-based AWS regions
- Network segmentation
- Private, per-person administrative access
- No public SSH
- Versioned, access-logged storage
- Single-tenant option for Enterprise
Network
- DDoS protection
- Bot mitigation and rate limiting
- Continuous threat detection
- Malware scanning
- Centralized logging and alerting
- Only required ports open
Organization
- Written security policies, reviewed annually
- Incident response plan, exercised annually
- Disaster recovery plan, tested annually
- Background checks and NDAs
- Annual security training
- Vendor security reviews
Product
- Two-factor authentication
- SAML single sign-on (Enterprise)
- Role-based permissions
- Login rate limiting
- Encrypted page-interaction credentials
- Activity logging
What security teams ask us first
Where is our data hosted?
On Amazon Web Services in United States regions. ChangeTower runs entirely in the cloud and operates no data centers or physical hardware of its own.
Does ChangeTower access our internal systems?
No. We reach only the pages you instruct us to monitor. Those pages may be public or may require sign-in steps you configure, but we never go beyond that scope and never need access to your network.
Do you support single sign-on and two-factor authentication?
Yes. Two-factor authentication is available to every user, and SAML single sign-on is available to Enterprise customers. Role-based permissions govern what each member of your workspace can see and do.
How are payments handled?
Subscription billing is processed by Stripe. Card numbers are entered directly with Stripe and never stored on ChangeTower systems.
Do you use subprocessors?
A short list of vetted providers for infrastructure, email, billing, support and analytics, each reviewed before engagement and again annually. The current list is available on request.
Do you support GDPR?
Yes. For customers in the EEA or UK we enter into a data processing agreement with standard contractual clauses, and we honor data subject requests.
Can we have a dedicated environment?
Enterprise customers can be provisioned on a single-tenant instance with its own storage and administrative access, arranged during contracting.
Can you complete our security questionnaire?
Yes. We complete due diligence questionnaires and vendor risk assessments in standard or custom formats, sign mutual NDAs and data processing agreements, and can share supporting documentation under NDA. Start with the request button on this page.
Need the full picture?
Our security team will walk you through how ChangeTower protects your data and answer whatever your review requires.
Trusted by teams at
