SolidPing — Privacy Policy
Version: 2.1 Effective Date: August 19, 2026 Previous versions: 2.0, August 9, 2026 — 1.0, May 3, 2026
This Privacy Policy describes how the SolidPing hosted service — the dashboard, API, check agents, status pages, and the SolidPing Slack and Discord apps (together, the "Service") — collects, uses, and protects personal data.
It applies only to the hosted offering. Your self-hosted use of the open-source SolidPing software is not covered by this policy: no data reaches us, and you act as controller for your own deployment. See Self-hosting & GDPR.
This policy is part of a set. The complete index is at Legal & GDPR.
1. Controller, and when we are only a processor
The Service is operated by:
WEBINGENIA SARL 14 rue Félix Faure, 75015 Paris, France SIREN: 519 411 680 — SIRET: 519 411 680 00043 Contact: contact@solidping.io
Our role depends on the data, and the distinction matters for who you should contact:
- We are the controller for our own relationship with you: your account and identity, billing, security and audit logs, abuse prevention, support, and aggregated product analytics. This policy describes that processing.
- We are a processor for the data inside a customer's organisation — monitoring configuration, incidents, the people that organisation adds as responders or subscribers. There, the customer is the controller and decides what happens to it. That processing is governed by our Data Processing Agreement.
If your employer gave you a SolidPing account, they are the controller of what is in it. Requests about that data go to them — see Your data.
We are not required to appoint a Data Protection Officer under Article 37 GDPR. Data protection matters are handled by the company's management at the address above.
2. Data we collect
Account and identity
- Email address, name, and (if available) avatar URL
- Password hash — Argon2id by default; we never store or log the password itself
- Two-factor authentication material: TOTP secret, recovery codes, WebAuthn credentials
- Where you sign in through an identity provider — Slack, Discord, Google, GitHub, GitLab, Microsoft, your own LDAP directory, or a generic OIDC provider — the user and workspace/organisation identifiers that provider returns, plus the name, email, and picture it releases
- Organisation membership, roles, and permissions
- Timestamps: account creation, last activity
Contact details you add for alerting
- Additional email addresses for notifications
- Phone numbers for SMS and voice escalation, with their verification state
- Web-push subscription endpoints
Phone verification stores a hash of the in-flight code, never the code itself, and discards it once verification completes or expires. How SMS and voice alerting works — opt-in, message frequency, and how to stop messages — is set out in the SMS & Messaging Policy.
Monitoring and incident data
- Check definitions: targets (hostname, URL, port), method, expected results, schedule, the region you want them run from
- Check results: timestamp, status, response time, error message
- Incidents: detection, escalation, acknowledgement, comments, resolution
- Maintenance windows, on-call schedules, escalation policies, check groups
- Status pages you publish and their content
Check definitions can contain personal data if you put it there — a hostname identifying an individual, a name in a check label. We treat this data as your content and do not inspect it.
Status-page subscribers
If you publish a status page and allow subscriptions, we store each subscriber's email address, their confirmation state, their subscription scope, and the tokens that let them confirm or unsubscribe. Subscribers are usually not account holders — they are third parties to whom the page owner is the controller.
Chat platform integrations
When the SolidPing app is installed in a Slack workspace or a Discord server:
- The workspace/server ID and name
- The user ID of the installer
- The bot user ID assigned to SolidPing
- The bot OAuth access token, encrypted at the application layer
- The scopes granted
- The channel IDs configured to receive notifications
- Slash-command invocations and interactions with the bot, processed so we can respond
- Direct messages to the bot — handled in transit; not retained beyond what is needed to respond
- Link unfurl requests — we receive the URL so we can render a preview; we do not retain the surrounding message
Technical and security data
- IP address, user agent, and timestamps of authentication events
- Audit-log entries for administrative actions
- Session and token lifecycle events
- Application error traces, which may incidentally include a user ID, IP address, or request path
Support and bug reports
The content of what you send us, including any in-app bug report and its attached diagnostic context.
What we do not collect
- We do not read or store the content of messages in your Slack or Discord channels
- We do not enumerate your workspace's member directory; we retain information only about people who sign in, install the app, or interact with the bot
- We do not access files in your chat workspaces
- We do not collect special-category data (Article 9 GDPR), and it is never required by the Service
- We do not carry out automated decision-making producing legal or similarly significant effects
- We do not sell personal data, use it for advertising, or use it to train machine-learning models
Product analytics
Where enabled, we use PostHog (EU instance, Frankfurt) to understand which features get used. It is built to be as thin as we could make it:
- You are identified by a pseudonymous value derived from organisation and user UUIDs — never an email address
- The event set is a small, closed list (organisation created, user signed up, check created, integration connected, status page published), and the client is structurally incapable of carrying an email, a check target, or free text
- Session recording is disabled; typed input values and element attributes are masked
- URLs are rewritten to route templates before leaving the browser, so organisation slugs and resource IDs are not transmitted
- Do Not Track is honoured, and you can opt out — see the Cookie Policy
Legal basis: legitimate interests. You may object at any time.
3. How we use your data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Operate and maintain the Service — run checks, detect incidents, send notifications, render dashboards and status pages | Contract — Art. 6(1)(b) |
| Authenticate you and authorise access | Contract — Art. 6(1)(b) |
| Send service-critical messages: incident reports, security notices, account changes | Contract — Art. 6(1)(b) |
| Provide support and handle bug reports | Contract — Art. 6(1)(b) |
| Send status-page updates to subscribers | Consent of the subscriber — Art. 6(1)(a) |
| Detect and prevent abuse, fraud, and security incidents | Legitimate interests — Art. 6(1)(f) |
| Improve the product through pseudonymous analytics | Legitimate interests — Art. 6(1)(f) |
| Comply with legal obligations (accounting, tax) | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interests, we have weighed them against your rights and concluded the processing is limited, expected, and not intrusive — the analytics design above is the main product of that assessment. You can object at contact@solidping.io.
4. Who we share data with
Sub-processors
We use a small number of sub-processors, listed in full — with what each does, where it processes data, and the transfer safeguard — at Sub-processors. In summary: OVHcloud (France) for the application, the database, and backups; Hostinger (France) and IONOS (United States) for regional check workers; Fly.io for additional check agents; PostHog (EU) for analytics; Sentry (EU) for error monitoring; and Twilio (United States) for SMS and voice alerts we send on our own provider credentials.
We give at least 30 days' notice before adding or replacing one.
Destinations you choose
When you configure SolidPing to send alerts to Slack, Discord, Microsoft Teams, Mattermost, Google Chat, Pushover, ntfy, Opsgenie, a phone number through your own Twilio account, a web-push endpoint, an email address, or any webhook, we transmit that alert to a recipient you designated. Those providers operate under their own terms with you, not with us. The same applies to the identity provider you use to sign in.
SMS and voice are the one case where this depends on how your organisation is set up. If it has connected its own Twilio account, the paragraph above applies. If it has not — the default — we send on our Twilio credentials, and Twilio is then our sub-processor rather than your provider; see Sub-processors.
Nobody else
We do not share personal data with anyone else, except where we are legally compelled to. If we receive a binding legal demand for customer data, we will notify the affected customer unless the law forbids it.
International transfers
Your account data, monitoring history, and backups stay in France. Two transfers outside the EEA can occur: check workers in non-EU regions — today a US worker at IONOS, plus Fly.io agents in the regions you select — and support access by EU-hosted providers headquartered in the US. Both rely on Standard Contractual Clauses, and the detail is at Sub-processors → International transfers. Restricting your checks to EU regions keeps your monitoring data in the EEA.
5. Retention
| Data | Retention |
|---|---|
| User account and profile | While the account is active; deleted within 30 days of a deletion request |
| Organisation data (checks, incidents, status pages) | While the organisation exists; purged after deletion |
| Raw check results | 24 hours by default, then aggregated |
| Hourly aggregates | 7 days by default |
| Daily aggregates | 2 months by default |
| Incident history | While the organisation is active |
| Status-page subscriptions | Until unsubscribed, or until the page is deleted |
| Slack/Discord workspace tokens and settings | While the app is installed; deleted 3 months after uninstall |
| Authentication and audit logs | 12 months |
| Application error traces | 90 days |
| Product analytics events | 12 months |
| Support correspondence | 24 months |
| Backups | Daily backups, expired on a rolling schedule |
| Billing and accounting records | 10 years (French commercial law) |
Uninstalling the SolidPing app from your Slack workspace (Apps → SolidPing → Remove) or your Discord server immediately revokes our bot token. Remaining workspace data is deleted within 3 months, or sooner on request.
6. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, object, and port your personal data, to withdraw consent where processing rests on it, and to lodge a complaint with a supervisory authority.
Most of this is self-service — profile editing, configuration export, organisation deletion, unsubscribing — and the rest is one email away. The full walkthrough, including who to contact when your account was created by an employer, is at Your data: access, export, deletion.
We respond within one month. The competent authority for us is the French CNIL; you may also complain to the authority where you live or work.
7. Security
Encryption in transit (TLS 1.2+) and at rest; a second layer of application-level encryption for OAuth tokens, integration credentials, and TOTP secrets; Argon2id password hashing; role-based access control and tenant isolation enforced at the data layer; least-privilege production access with mandatory MFA and audit logging; daily encrypted backups with a tested restore procedure.
The full description is at Security measures.
We notify affected customers of a personal data breach within 48 hours of becoming aware of it, and the supervisory authority within 72 hours where Article 33 applies to us as controller.
8. Cookies
The marketing site (www.solidping.io) sets no cookies. The dashboard sets
only what is needed to keep you signed in, plus one interface preference.
Analytics cookies are optional, off unless configured, and refusable. Every
cookie and storage key is listed in the Cookie Policy.
9. Children
The Service is not directed at children under 16, is not designed for personal use, and we do not knowingly collect personal data from children. If you believe a child has provided us data, email us and we will delete it.
10. Changes to this policy
We may update this policy. Material changes are announced on this page and, where they affect your rights, by email to account holders at least 30 days in advance. The version number and Effective Date at the top identify the current version.
11. Contact
- Company: WEBINGENIA SARL
- Address: 14 rue Félix Faure, 75015 Paris, France
- Email: contact@solidping.io
- All legal documents: solidping.io/legal
- GitHub: github.com/fclairamb/solidping