# Instatus

> Runs a public or private status page on which a software vendor announces incidents and maintenance, checks its own services from the outside and notifies subscribers by email, SMS or chat.

- Vendor: Instatus, Inc
- Canonical URL: https://www.convios.com/en/toolbox/instatus
- Language version: https://www.convios.com/de/werkzeugkasten/instatus
- Area: Service & support · Cluster: status page and incident notice
- Role: Off-the-shelf product · Origin: Established
- As of: 2026-09-28 · Reviewed: 2026-09-28 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: A competitor can set up a status page in an hour (estimate). Without one, you answer the same question a hundred times in the inbox at the first larger outage. The Instatus documents carry traces of a template: the policies note that they were adapted from Basecamp, and the page on the uptime commitment still describes the product in Basecamp's words as the place for decisions, designs and company announcements. Anyone selling to a large enterprise exposes their own status page to its review.

## Suitability by company size

- Solo: suitable — The free plan covers a public page with 15 monitors at two-minute intervals, email alerts, five team members and 200 subscribers. A custom domain is missing, and the page runs under the vendor's domain. Someone running a product alone thereby gets a credible answer to the question whether something is broken right now, without a contract and without a payment method.
- Mid-market: suitable — This is where the tool belongs. Pro costs 20 USD a month, 15 USD on annual billing, and brings 50 monitors at 30-second intervals, SMS alerts, a custom domain and 5,000 subscribers. Two limits belong on the same note. Sign-in through your own directory service and the administrator view of the change log arrive only on the Business plan at 300 USD a month. And no plan offers European hosting.
- Enterprise: suitable with caveats — Business costs 225 USD a month on annual billing, so 2,700 USD a year, with SAML sign-in, an administrator log and 1,000 monitors; Enterprise offers custom contracts and custom policies. The documents yield three findings. The vendor writes itself that it has not completed a SOC audit. The databases are, by its own account, unencrypted at rest. And the data processing agreement dates from 2022, still mentions Privacy Shield and promises third-party audit reports the security whitepaper does not name; the vendor offers custom versions from Business. The volume of data is small, mostly subscriber addresses and team members. Where procurement allows an exception for that, Enterprise is the route.

## Vendor staying power

Young: The product has been on the market since summer 2020 and is developed further at a monthly cadence. Funding is not documented by any primary source; on its pricing page the company describes itself, by its own account, as profitable and founder-led. Under the scale of this collection, funding that is not public leads to the classification young, even after more than three years on the market. The vendor publishes its revenue figures itself, without third-party review.

- Contracting entity: Instatus, Inc, according to the data processing agreement a Delaware C Corporation with a mailbox address in Beaverton, Oregon; the terms of service name neither a state of incorporation nor an address, neither governing law nor venue, and the vendor reserves the right to change them without notice; the privacy policy says the site is operated from Egypt and hosted in the United States (source: https://instatus.com/policies/terms, as of 2026-09-28)
- Revenue and customers, by the vendor's own account: the /open page, marked “Updated August 25” without a year, shows monthly revenue of 50,105 USD, annual revenue of 601,263 USD, 1,354 paying customers and 67,522 users; the vendor names no third-party review (source: https://instatus.com/open, as of 2026-09-21)
- Ongoing development: the public changelog reaches back to July 2020 and carries entries for every month from January to August 2026, most recently in August 2026 the interface in 26 languages and push alerts to the phone (source: https://instatus.com/changes, as of 2026-09-21)
- Own status page: the vendor's own status page at instat.us shows no notice for July, August and September 2026 and 100 percent availability for all ten entries shown; the addresses status.instatus.com and trust.instatus.com by contrast show status pages of unrelated customers (source: https://instat.us/history, as of 2026-09-21)
- State of the legal documents: the data processing agreement carries the revision of 23 June 2022, sits as a PDF on the vendor's own website and can be countersigned via Dropbox Sign; the policies carry the note that they were adapted from Basecamp, and the page on the uptime commitment still describes the product in Basecamp's words (source: https://instatus.com/policies/sla, as of 2026-09-28)

## Cost of leaving

Low: After the export, little is missing for a status page. Subscribers can be exported as CSV; incidents, maintenance, components and monitors are available through the API. Three points cost time. The status page address has to be re-pointed in DNS. The subscribers change sender; if a new service writes to them without warning, the mail can end up in spam. The deadline is short: on cancellation the account becomes inaccessible at once, after 30 days the data is deleted from live systems and after 60 days from backups. The export therefore belongs before the cancellation.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | yes, publicly available as a PDF (revision of 23 June 2022), by its own text part of the terms of service, with EU standard contractual clauses; countersignature via Dropbox Sign optional, custom versions from Business — The page on the General Data Protection Regulation links the data processing agreement directly as a PDF, without sign-in and without a plan requirement. The text calls itself part of the terms of service and the privacy policy and names Instatus, Inc as processor. It contains the 2021 EU standard contractual clauses for controllers and for processors, with Danish law and courts, plus the UK clauses. New subprocessors are announced in advance, and the customer may object within ten business days. Anyone needing a signed copy countersigns on a self-serve basis via instatus.com/dpa at Dropbox Sign; the pricing page names custom agreements from the Business plan. Three points belong in procurement's review. The text dates from June 2022 and still mentions Privacy Shield. The technical and organisational measures only point to the security page and the privacy policy. And the promise to provide third-party audit reports meets a security whitepaper that names no completed audit. | evidenced | 2026-09-28 |
| Storage location | United States, at Amazon Web Services and Vercel, with no selectable European region on any plan — The security whitepaper places the primary data centres in the United States at Amazon Web Services, the privacy policy says the site is hosted in the United States, and the subprocessor list names Vercel and Amazon Web Services as cloud providers located there. No European hosting location appears on the pricing page, in the policies or in the help pages checked, not even as an add-on on the Enterprise plan (checked on 28 September 2026). | partially evidenced | 2026-09-28 |
| Subprocessors | public list with eight entries, purpose and country named, all in the United States; three discrepancies with other documents of the vendor — The list names Vercel, Amazon Web Services, Mailgun, Paddle, Google Analytics, Sentry, Twilio and WorkOS, each with purpose and the United States as country, and is visible without signing in. It carries no date; the procedure for changes is set out in the data processing agreement, which announces new subprocessors in advance and allows an objection within ten business days. Three places do not match it. The help page on SAML sign-in routes the setup through a service called OrbitID, which is missing from the list, while WorkOS stands there as the sign-in provider; no document says how the two relate. The changelog describes automatic translation of content, while no translation service appears in the list. And the policies name customer support software as a subprocessor category, while no such service is listed. | partially evidenced | 2026-09-28 |
| Third-country transfer | processing in the United States, operation from Egypt; the data processing agreement anchors EU standard contractual clauses for the transfer to Instatus, Inc; no document names a basis for subprocessors or for access from Egypt; no entry in the EU-US Data Privacy Framework — The privacy policy says the site is operated from Egypt and hosted in the United States, and bases the transfer on consent through mere use. The data processing agreement governs the transfer to Instatus, Inc in Beaverton, Oregon, through the 2021 EU standard contractual clauses. The eight subprocessors are all located in the United States; for them the agreement only names contracts with equivalent protection, without a transfer basis per recipient. No document says anything about access from Egypt, a country without an adequacy decision. The official Data Privacy Framework participant list returned no match for Instatus on 21 September 2026. | partially evidenced | 2026-09-28 |
| Training on customer data | no statement; automatic translation and continuously updated incident descriptions run through an unnamed service — Reviewed were the privacy policy, the terms of service, the security whitepaper, the subprocessor list, the pricing page and the changelog. None of them mentions model training or a provider of language models. The product mainly processes incident texts that become public anyway, plus subscriber addresses and measurements. Two changelog entries concern customer content: automatic translation when switching language, and since August 2026 team-internal incident descriptions that update themselves as the incident evolves. Whether a language model does that work, and which service runs it, is stated nowhere. The rating stays yellow: red requires a documented AI function on customer content, and none is documented here. Anyone wanting to use either feature should settle the question with the vendor before adoption. | partially evidenced | 2026-09-28 |
| Retention and deletion | deletion after cancellation promised and quantified: 30 days from live systems and logs, 60 days from backups — The terms of service, the cancellation policy and the security whitepaper name the same periods consistently. On cancellation the content becomes inaccessible at once, after 30 days it is deleted from live systems and logs, and after 60 days from the backups, which are stored off-site. The vendor rules out restoring a single account from backup. Free accounts are additionally deleted after 365 days of inactivity, frozen accounts after 180 days. | evidenced | 2026-09-21 |
| Certifications | none named; according to the vendor's security whitepaper no SOC audit has been completed and the databases are not encrypted at rest — On audits, the security whitepaper states that a SOC audit has not been completed and that a self-assessment for PCI is in progress. It describes access over a VPN with a second factor, logging of all account access by IP address, daily backups encrypted with GPG, and recovery drills. It also states that the databases are not encrypted at rest and that staff are not background-checked. No document names an ISO 27001 certificate, a C5 attestation or a trust portal. A security page exists; the evidence is the vendor's self-declaration. The data processing agreement by contrast states in section 7.2 that the vendor has obtained third-party audits and will provide the reports on request; its own statements therefore contradict each other. | partially evidenced | 2026-09-28 |
| EU AI Act, Article 50 | no statement on the regulation; the tool contains no recognisable AI system that faces end customers — Regulation (EU) 2024/1689 appears in none of the documents reviewed. According to the changelog, the tool updates incident descriptions that only the own team sees, and translates content on a language switch, where the operator can edit the translation before publishing. The vendor describes no machine that answers visitors of the status page directly. Responsibility for published texts therefore stays with the operator who approves them. | partially evidenced | 2026-09-21 |
| Audit logging | change log present, administrator view only on the Business plan; retention period and export not named — The help page on the activity log describes two views. Every incident, maintenance and template carries its own history on all plans. The administrator view of changes to the team, the status page, notifications and credentials is visible only to administrators on the Business plan. How long the log is kept and whether it can be exported into your own systems is stated neither on the help page nor on the pricing page (checked on 28 September 2026). | partially evidenced | 2026-09-21 |

## Cost

- Entry: The free Starter plan covers 15 monitors at two-minute intervals, email alerts, five team members and 200 subscribers, without a custom domain. Pro costs 20 USD a month, 15 USD on annual billing, with 50 monitors at 30-second intervals, SMS alerts, a custom domain and 5,000 subscribers. Business costs 300 USD a month, 225 USD on annual billing, with 1,000 monitors, alerts by phone call, SAML sign-in and 25,000 subscribers. Enterprise goes through a conversation. The page quotes prices in US dollars only and per status page, independent of the number of users; Business covers up to three pages, and Pro also comes as Private Pro at 50 USD and Select at 100 USD a month. (as of 2026-09-28)
- Where it gets expensive: Extra cost arises at one point: between Pro and Business lies a factor of 15. Private pages and pages for selected customer groups already exist as variants of Pro, at 50 and 100 USD a month, 37.50 and 75 USD on annual billing. Anyone needing sign-in through their own directory service or the administrator view of the change log, however, jumps from 180 to 2,700 USD a year. For a team of twelve that is 225 USD per person and year (own calculation). The pricing page names a 99.99 percent uptime commitment only for Enterprise; the vendor's own policy on it promises 99 percent for Pro.

## Three routes compared

### The established status page next to it

Atlassian Statuspage is the buy option this decision gets measured against, and Instatus runs a dedicated import path for its customers. On 28 September 2026 Atlassian charges 99 USD a month for the public page on Startup with 1,000 subscribers, and 399 USD on Business for 5,000 subscribers with roles and permissions. At Instatus 5,000 subscribers cost 20 USD a month on Pro.

### The status page as a by-product of incident response

The younger design puts the status page at the end of an incident response process in which language models take notes. On 28 September 2026 incident.io already includes the status page on its free plan and then bills per user, 19 USD a month on Team and 25 USD on Pro; the writing aid and the model's suggestions start only on Pro, as does SAML sign-in. The flow runs from alerting to post-mortem, and the price grows with every person on call.

### Static page on your own edge, delivery through a building block

The page itself is quick to build. From this toolbox: Astro generates a static status page from incident files in the repository, Cloudflare Pages serves it, Resend sends notifications to subscribers, Sentry supplies the error signal, and n8n connects alert and publication. On the order of magnitude (estimate): 8 to 15 person-days at 1,100 EUR give 8,800 to 16,500 EUR one-off, against 180 USD a year for Pro. Three places are costly. The status page has to stay reachable when your own environment goes down, so it must run on separate infrastructure and a separate domain. Subscriber management needs confirmation, unsubscribe and deliverability. And monitoring from the outside has to check from several regions and open the incident when a check fails.

Recommendation by size:

- Solo: The free plan is enough. The page runs under the vendor's domain; that is enough for a start.
- Mid-market: Buy, Pro. Before adoption, countersign the data processing agreement and ask which service produces translations and incident descriptions and whether staff access customer data from Egypt.
- Enterprise: For large enterprises a completed SOC audit is missing. Where procurement allows an exception because of the small volume of data, negotiate Enterprise with a custom contract.

## Context

- Implements method: [Service Blueprinting](https://www.convios.com/en/methods/service-blueprinting) — The status page sits on the line of visibility this method draws: an internal failure becomes visible to the outside there. That is also where it is decided whether the customer learns of it from the vendor or from their own outage.
- Implements method: [DORA Delivery Diagnostic](https://www.convios.com/en/methods/dora-delivery-diagnose) — This method measures time to restore after a failure. An incident archive with start, updates and end per incident supplies data points for that time.
- Implements method: [Good-Better-Best Pricing](https://www.convios.com/en/methods/good-better-best) — Starter, Pro, Business and Enterprise form a ladder, plus the Pro variants Private Pro and Select. Between Pro and Business lies a factor of 15, and sign-in through your own directory service sits on Business. The method helps check whether this tier opens the way up or blocks it.
- Alternative: [Sentry](https://www.convios.com/en/toolbox/sentry)
- Alternative: [Resend](https://www.convios.com/en/toolbox/resend)
- Alternative: [Astro](https://www.convios.com/en/toolbox/astro)
- Alternative: [Cloudflare Pages](https://www.convios.com/en/toolbox/cloudflare-pages)
- Displaces: An outage banner on your own website, which is itself down, A mass email to customers from a personal mailbox, The same answer to the same question in support, a hundred times, Availability figures from memory in a customer conversation

## Evidence

- Plan prices: Starter free, Pro 20 USD and Business 300 USD a month, 15 and 225 USD on annual billing; Starter with 15 monitors and 200 subscribers, Pro with 50 monitors and 5,000 subscribers, Business with 1,000 monitors, SAML and 25,000 subscribers (variants Private Pro 50 USD and Select 100 USD, billing per status page) — https://instatus.com/pricing (as of 2026-09-28)
- The page on the General Data Protection Regulation links the data processing agreement as a public PDF (revision of 23 June 2022); it calls itself part of the terms of service, contains the 2021 EU standard contractual clauses under Danish law and describes Instatus, Inc as a Delaware C Corporation; countersignature is possible via instatus.com/dpa at Dropbox Sign — https://instatus.com/instatus-dpa-2022-06.pdf (as of 2026-09-28)
- The subprocessor list names eight services, all located in the United States: Vercel, Amazon Web Services, Mailgun, Paddle, Google Analytics, Sentry, Twilio and WorkOS — https://instatus.com/policies/subprocessors (as of 2026-09-21)
- The help page on SAML sign-in names the Business plan as a prerequisite and routes the setup through a service called OrbitID — https://instatus.com/help/team/sso (as of 2026-09-21)
- The privacy policy says the site is operated from Egypt and hosted in the United States, and that anyone using the site or a service consents to the transfer; after cancellation nothing is stored for longer than 30 days — https://instatus.com/policies/privacy (as of 2026-09-21)
- The official participant list of the EU-US Data Privacy Framework returns no match for a search for Instatus; the same search for a listed company returns one as a cross-check — https://www.dataprivacyframework.gov/list (as of 2026-09-21)
- The security whitepaper says a SOC audit has not been completed, the databases are not encrypted at rest and staff are not background-checked; the data centres are at Amazon Web Services in the United States — https://instatus.com/policies/security/whitepaper (as of 2026-09-28)
- The terms of service name Instatus, Inc as the contracting party without state of incorporation, address, governing law or venue and reserve changes without notice; deletion happens within 30 days from live systems and within 60 days from backups — https://instatus.com/policies/terms (as of 2026-09-21)
- The page on the uptime commitment promises 99 percent monthly for Pro and describes the product as the place where decisions are made, designs are shared and company announcements are broadcast; the policies carry the note that they were adapted from Basecamp — https://instatus.com/policies/sla (as of 2026-09-21)
- The cancellation policy says the account is inaccessible immediately after cancellation, data is deleted within 30 days from live systems and within 60 days from backups, and free accounts are deleted after 365 days of inactivity — https://instatus.com/policies/cancellation (as of 2026-09-21)
- The activity log keeps a history per incident, maintenance and template on all plans; the administrator view of changes to the team and the status page is visible only to administrators on the Business plan — https://instatus.com/help/team/activity (as of 2026-09-21)
- The /open page, marked “Updated August 25” without a year, shows monthly revenue of 50,105 USD, annual revenue of 601,263 USD and 1,354 paying customers — https://instatus.com/open (as of 2026-09-21)
- The changelog reaches back to July 2020, carries entries for every month from January to August 2026 and describes automatic translation of content on a language switch as well as, since August 2026, self-updating incident descriptions — https://instatus.com/changes (as of 2026-09-28)
- The vendor's own status page at instat.us shows no notice for July, August and September 2026 — https://instat.us/history (as of 2026-09-21)
- Atlassian Statuspage charges 99 USD a month for the public page on Startup for 1,000 subscribers and 399 USD on Business for 5,000 subscribers with roles and permissions — https://www.atlassian.com/software/statuspage/pricing (as of 2026-09-28)
- incident.io includes the status page on its free Basic plan and then bills per user, 19 USD a month on Team and 25 USD on Pro; SAML and the model features start on Pro — https://incident.io/pricing (as of 2026-09-28)
- Page on the General Data Protection Regulation linking the data processing agreement — https://instatus.com/policies/gdpr (as of 2026-09-28)