Encrypted secrets
API keys, tokens, passwords and test credentials are encrypted at rest and are never shown again in full after you save them. They are masked in logs, incidents, AI summaries and client reports.
Isolated, SSRF-protected workers
Checks run on dedicated workers that refuse requests to private, loopback and cloud-metadata addresses, so a monitored URL can never be used to reach internal infrastructure.
Safe testing on live websites
- Payment and checkout requests are blocked by default.
- Every test run uses a unique test email address and sends an identifying header so you can filter it out.
- A form must be marked safe to repeat before it can be scheduled.
- Watchfront never changes content or settings on a production website.
Access control
Workspaces use role-based access — owner, admin, member and read-only client — and clients only ever see the websites assigned to them. Shared report links are unguessable and can be revoked at any time.
Data retention
Check results, screenshots and error events are kept only for the history period of your plan (7 to 365 days) and are then deleted automatically. Deleting a website removes its data.
The browser error script
The optional script collects JavaScript error messages, stack traces, page URL and browser type. It does not record keystrokes, form values, cookies or session replays.
Responsible disclosure
Found a vulnerability? Email likhith.reddy@watchfront.in with the details. We acknowledge reports within two business days and won't pursue good-faith research.