Privacy

Last changed 16 October 2026.

Outpost is run by Vincent Jacobs, trading as Code & Vin, in South Africa, and Vincent Jacobs, trading as Code & Vin is responsible for the personal information it holds under the Protection of Personal Information Act (POPIA). To ask about anything here, write to Vincent@codeandvin.com.

What Outpost collects

Your login: your email address, your name if you give it, and your password as a one-way hash, never the password itself.
What you record in the registry: who holds each account, who can make changes, and where logins are kept, such as “the finance team’s vault”. These entries can name people, such as your developer or IT lead. Outpost never asks for, and has nowhere to store, a password for any website you monitor.
What Outpost finds about your sites: the results of its checks and scans, which only use what anyone can see of a site from outside.
What people in your account do: an activity log of changes, with the name of whoever made them, and the email addresses of people you invite.
Payments: handled by Dodo Payments. Outpost receives the subscription’s status, the amounts paid, and the name and email address given at checkout. It never sees card details.
The public check: the domain you enter, and the general result, kept for a day so the same site is not checked again and again. Your internet address is used, without being stored, to limit how often one visitor can check.
The Agency waiting list: the email address and answers you leave on the form, used only to tell you when Agency is ready.

Why

To run the service you signed up for: to watch your sites, tell the right people when something breaks, keep the record of who controls what, and send the summaries you receive. Outpost does not sell personal information, does not use it for advertising, and does not track you across other websites.

People you record

When you record other people in your account, your organisation decides what is recorded and why, and is responsible for it under POPIA. Vincent Jacobs, trading as Code & Vin holds and processes it on your behalf, only to run Outpost for you, and keeps it secure and confidential.

Who else handles it

Outpost uses a few other services to do its job. Some of them are outside South Africa; sending information to them is needed to provide the service you signed up for.

Hetzner Online, whose server in Helsinki, Finland, in the European Union, runs Outpost and stores everything.
Resend, which delivers Outpost’s emails, so it sees the email addresses they go to.
Dodo Payments, which sells and bills subscriptions as the merchant of record. What you give at checkout is also covered by Dodo’s own privacy policy.
Slack, if you connect it, which receives your alerts in the channel you chose.
A heartbeat service, if you set one, which is called once a minute and is sent nothing else.
Google Web Risk and WordPress.org, which are asked about your sites’ addresses and software, and Team Cymru, which is asked about your sites’ internet addresses. None of these is sent anything about you.
Wordfence, CISA (the US Cybersecurity and Infrastructure Security Agency), endoflife.date and Retire.js, whose lists of known vulnerabilities and unsupported software Outpost downloads whole once a day. None of them is sent anything: not which sites you watch, nor anything about you.

How long it is kept

For as long as your account exists, except the result of each individual uptime, certificate and domain check, which is kept for 90 days; outages, findings and the registry stay. Deleting your account removes everything recorded in it at once; copies in backups are gone within 30 days. Deleting your login removes your personal details, though the activity log of an account you belonged to keeps your name against what you changed. Records of payments received from Dodo Payments are kept after an account is deleted, for accounting. The Agency waiting list is kept until Agency is ready or you ask to be taken off it.

Cookies

Only the cookies Outpost needs: those that log you in and keep you logged in, and one that lasts ten minutes while you connect Slack. No advertising or analytics cookies, and nothing that follows you to other websites.

How it is protected

Every connection is encrypted. Passwords are stored only as hashes, and the tokens you save on the settings screen are sealed with a key kept apart from the database. Specifics about a site, such as usernames and versions, are shown only to someone who has proved they control its domain.

Your rights

You can see, correct, download or delete the personal information Outpost holds about you, and object to how it is used. You can download your data and delete your login yourself from the Team page, and delete a whole account from Settings. For anything else, write to Vincent@codeandvin.com. If you are not satisfied with the answer, you can complain to the Information Regulator.

Changes

If this policy changes in a way that matters, everyone with an account is told by email before it takes effect.

What Outpost collects

Your login: your email address, your name if you give it, and your password as a one-way hash, never the password itself.

What you record in the registry: who holds each account, who can make changes, and where logins are kept, such as “the finance team’s vault”. These entries can name people, such as your developer or IT lead. Outpost never asks for, and has nowhere to store, a password for any website you monitor.

What Outpost finds about your sites: the results of its checks and scans, which only use what anyone can see of a site from outside.

What people in your account do: an activity log of changes, with the name of whoever made them, and the email addresses of people you invite.

Payments: handled by Dodo Payments. Outpost receives the subscription’s status, the amounts paid, and the name and email address given at checkout. It never sees card details.

The public check: the domain you enter, and the general result, kept for a day so the same site is not checked again and again. Your internet address is used, without being stored, to limit how often one visitor can check.

The Agency waiting list: the email address and answers you leave on the form, used only to tell you when Agency is ready.

Why

Who else handles it

Outpost uses a few other services to do its job. Some of them are outside South Africa; sending information to them is needed to provide the service you signed up for.

Hetzner Online, whose server in Helsinki, Finland, in the European Union, runs Outpost and stores everything.

Resend, which delivers Outpost’s emails, so it sees the email addresses they go to.

Dodo Payments, which sells and bills subscriptions as the merchant of record. What you give at checkout is also covered by Dodo’s own privacy policy.

Slack, if you connect it, which receives your alerts in the channel you chose.

A heartbeat service, if you set one, which is called once a minute and is sent nothing else.

Google Web Risk and WordPress.org, which are asked about your sites’ addresses and software, and Team Cymru, which is asked about your sites’ internet addresses. None of these is sent anything about you.

Wordfence, CISA (the US Cybersecurity and Infrastructure Security Agency), endoflife.date and Retire.js, whose lists of known vulnerabilities and unsupported software Outpost downloads whole once a day. None of them is sent anything: not which sites you watch, nor anything about you.

How long it is kept

Your rights