TerrAlert encrypts every connection with TLS 1.2 or 1.3, encrypts stored webhook signing secrets at field level, supports multi-factor authentication on accounts, signs outbound webhooks with HMAC so you can verify them, and lets you export your data or delete your account from the Account page. Encryption at rest beyond the hosting provider's disk defaults has not been independently verified; the security page lists what is and is not in place.
To report a vulnerability, email security@terralert.io.