Trust & Security at ExpiryHawk

1. External Check Origin & Scan Cadence

ExpiryHawk probes your endpoints externally over the public internet using a dedicated Go TLS inspection engine (ssl-checker-go) and official ICANN RDAP / WHOIS registries. Because checks originate outside your VPC or hosting panel, they surface issues internal cron jobs miss—including edge CDN misconfigurations, expired intermediates, and SNI routing mismatches.

• Automated twice-daily schedule: Active domains are evaluated on a 12-hour cycle by default via Minion background workers.
• On-demand verification: You can trigger a manual re-check for any monitored domain directly from the dashboard after renewing a certificate or updating DNS.
• Supported endpoints: HTTPS (443), custom TCP ports (e.g., 8443), and TLS mail/directory services (SMTPS, IMAPS, POP3S, FTPS, LDAPS).

2. Failed Scans vs. Certificate Errors & Alert Retries

Temporary network blips should never masquerade as a healthy check or overwrite valid expiration history. ExpiryHawk distinguishes between reachability failures and cryptographic certificate errors:

• Distinct health states: TLS chain and expiry issues (expired, expiring, untrusted_root, self_signed, hostname_mismatch, revoked) are tracked separately from network reachability issues (connection_failed, nxdomain).
• Automatic alert delivery retries: When a downstream email relay, Telegram API, Web Push endpoint, or custom webhook returns a transient error, the alert dispatcher automatically retries with backoff delays of 60 seconds, 300 seconds, and 900 seconds.
• Resolution notices: Once a warning or expired certificate is replaced by a valid renewed certificate, recovery notifications are dispatched automatically.

3. Credential, Session & Webhook Security

• Origin-bound Passkeys (WebAuthn / FIDO2): Passwordless biometric and hardware-key logins verify asymmetric signatures bound strictly to our domain origin—private keys never leave your device.
• TOTP 2FA & bcrypt hashing: Passwords are salted and hashed with bcrypt; accounts support TOTP authenticator apps alongside Google and GitHub OAuth.
• HMAC-SHA256 Webhook signatures: Outgoing webhooks can be configured with a signing secret so receivers can verify every request via the X-ExpiryHawk-Signature header and replay timestamp.
• Transport & browser headers: All traffic uses TLS 1.2/1.3, and responses include baseline hardening headers (X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy).

4. Data Retention & Self-Service Deletion

• Public diagnostic logs: Anonymous tool check logs used for rate-limiting and operational diagnostics are archived/purged on a rolling 90-day retention schedule.
• Full user ownership: Monitored domains, custom alert channels, webhook endpoints, and Passkey credentials can be added, inspected, or deleted immediately from your dashboard at any time.
• Privacy-first usage: We never sell domain lists, OAuth profile data, or endpoint telemetry to third parties.

5. Security & Support Contact

To report a security issue, ask about compliance, or request full account deletion, email [email protected].