Website Monitoring Security at WebsiteChange
Website monitoring security starts with what a monitor is allowed to touch. WebsiteChange reads only public pages, keeps your watchlist private to your workspace, encrypts your data in transit and at rest, and lets you delete monitors and history whenever you want. This page explains how we handle your data, how access is controlled inside a team, and how to report a security issue.
We fetch public pages and nothing else
Each check requests a publicly reachable page, renders it, and stores its text, HTML structure and a full-page screenshot. That is the whole job. We do not reach anything a regular visitor could not see without an account.
This keeps the service on the right side of the sites you watch, and it means there are no third party credentials in your account for anyone to steal.
- robots.txt is respected. If a site asks automated visitors to stay away from a path, we do not fetch it.
- We never log in on your behalf, and we never ask you for passwords to the sites you watch.
- We never solve CAPTCHAs and never bypass paywalls or access controls.
- Checks against the same host are spaced politely, even on the fastest plans.
What we store and how it is protected
Your account holds a small set of data: your email address, a password hash, your monitors and their settings, the stored versions of each watched page, alert routes and API keys. Billing details are handled by a payment processor and card numbers never reach our servers.
The pages you monitor are public by definition, but the list of pages you chose to watch tells a story about your business. We treat the watchlist as confidential.
- All traffic between your browser, our application and our API uses encrypted connections.
- Stored data, including page versions and screenshots, is encrypted at rest.
- Passwords are stored only as a one way hash.
- When a summary is written, the AI model receives only the trimmed text difference of the public page, never your account details.
Your watchlist stays private to your workspace
Monitors, versions, summaries and alert routes belong to a workspace. Only members of that workspace can see them. Agencies and larger teams use separate workspaces for clients or departments, so one client never sees another client's watchlist.
- Starter includes 1 workspace, Growth 3, Business 15, and Enterprise is unlimited.
- Members are invited by email and confirm their address with a code before they get access.
- Removing a member ends their access to the workspace straight away.
Roles, SSO and audit log
Access control grows with the plan, so larger teams get the controls their security reviews ask for.
| Control | Starter | Growth | Business | Enterprise |
|---|---|---|---|---|
| Seats | 2 | 10 | 30 | unlimited |
| Roles | no | no | yes | yes |
| SSO (SAML) | no | no | yes | yes |
| SCIM user provisioning | no | no | no | yes |
| Audit log | no | no | yes | yes |
| Custom retention | no | no | no | yes |
Roles separate people who can add, edit or delete monitors from people who can only read changes. The audit log records who changed what and when, including new monitors, deleted history, changed alert routes and new API keys. SSO lets your identity provider decide who can sign in, and SCIM on Enterprise adds and removes users automatically when your directory changes.
Retention per plan and deleting data
Version history is kept for 6 months on Starter, 2 years on Growth, 5 years on Business and without a time limit on Enterprise. Enterprise can also set custom retention per workspace, shorter or longer, to match an internal records policy.
You can delete a single version, a monitor with its full history, or a whole workspace at any time. Deleted data is removed from the application right away and cleared from backups as they rotate. Closing your account deletes your monitors and history as well. Billing records that the law requires us to keep stay with the payment records only.
API keys per workspace
API access is available on Growth (read API), Business and Enterprise (full API). Keys are issued per workspace, so a key only reaches the monitors and versions of that workspace. You can create several keys, name them after the system that uses them, and revoke any key instantly. On Business and Enterprise, key creation and revocation appear in the audit log. Read more on the website change monitoring api page.
Reporting a security issue
If you believe you found a vulnerability in WebsiteChange, email [email protected] with a description, the steps to reproduce it and the affected URL or endpoint. Please do not access other customers' data, do not degrade the service for others, and give us reasonable time to fix the issue before sharing details publicly. We reply within one business day.
For product questions, see the website change monitoring faq, compare plans on the website change monitoring pricing page, or read how website change detection works.
Watch your first page
Try the demo on the home page with any public URL. You get a real first snapshot and a sample change summary, with no card.