Uptime monitoring DSGVO: what a check stores, and where

“Uptime monitoring DSGVO” is the phrase people in Germany type when they want to know where an uptime check lives, who else touches the data, and whether the vendor is quietly a US subprocessors list with a European login page. This is how HyperMonitors is actually set up. It is a description of the service, not legal advice, and it does not tell you whether your own use of monitoring is lawful.

Uptime monitoring and the GDPR: the data is not the page

A monitor stores the target you configured (a URL, a host, a port), the schedule, the result of each check, and the alert rules. That is operational data about your service. It becomes personal data where it identifies a person: the account email, who is on call, the address a status-page subscriber confirmed, the content of an alert you chose to send to Slack. We do not sell it. The privacy policy is the full list; the short version is that account data stays with the application, and a probe only receives what it needs to perform the check.

Swiss hosting, under an adequacy decision

HyperMonitors is operated by unaxus GmbH, Espenstrasse 137, 9443 Widnau, Switzerland. The database, authentication and mail server run on machines we operate in Switzerland, not on a third-party application platform. Switzerland has an EU adequacy decision, so a transfer from the EEA to that infrastructure does not need an extra safeguard on top. The marketing site and the app are available in German. You set the language on the account, and an organization can set a default for team emails. A public status page is shown in the organization’s language, English or German.

Probe regions are a choice, and a failure check leaves the home region

Checks run from Zurich, New York and Singapore. You choose which of those a monitor uses, within the number your plan allows: one on Free, two on Solo, three on Team and Enterprise. A probe receives the target URL or host and returns the result. It does not receive your account. The database those results are written to stays in Switzerland.

One detail matters for a record of processing. Even a monitor whose regular region is Zurich asks a second region to confirm a failed check before an alert is sent. For that one request, the target URL is fetched from New York or Singapore. There is no switch to turn that re-check off. If a target must never be requested from outside Switzerland, write that down as a limit of this setup, because a failed check will still be repeated from another region.

Sub-processors you can name

• Stripe, for billing. Prices are the same number in USD, EUR and CHF, chosen from the checkout country. The first paid month is a 30-day trial.
• LabsMobile, for SMS. SMS is not on the free plan. If you never add an SMS channel, that processor does not see your alerts.
• The alert services you connect yourself — Slack, Discord, Telegram, Microsoft Teams, PagerDuty, or a webhook you operate. They receive the alert you configured, because that is the delivery you asked for.

Where a processor operates outside Switzerland or the EEA, the privacy policy states that the transfer uses an appropriate safeguard such as EU Standard Contractual Clauses. The named list is the list. There is no second appendix.

Rights you can use without writing to us first

Under the Swiss Federal Act on Data Protection and, where it applies to you, the GDPR, you can access, correct, export and delete your personal data, and restrict or object to certain processing. Deleting the account in Settings removes the monitors, the check logs and the alert configuration. For a copy, or for anything the settings screen does not do, the contact address is in the privacy policy. A complaint can go to the Swiss Federal Data Protection and Information Commissioner, or to your EU authority if you are in the EU.

None of this makes a competitor non-compliant, and none of it finishes your own record of processing. It is the part a vendor can actually put in writing: where the machines are, who the processors are, and how you delete the account. The longer product page is the GDPR note, and the comparisons with UptimeRobot and Pingdom are separate pages — link them when the question is “which product”, not when the question is “where does the data sit”.