Security and privacy

Hosting and data residency

• Every event, visitor and account is stored in AWS eu-west-1, in Ireland, and so are the backups.
• The service runs on managed AWS services (Lambda, DynamoDB, S3, CloudFront and SES for email) and on ClickHouse Cloud, which keeps a searchable copy of the events and the audit logs on AWS in Ireland. There are no servers of our own to patch.
• Requests arrive at the CloudFront edge location nearest to the visitor, which can be outside the EU, and travel on to Ireland encrypted.
• IP details come from ipapi.is, in Germany, which only receives the IP address.

Encryption

• All traffic to the agent, the API and the dashboard uses TLS.
• The databases are encrypted at rest by AWS and ClickHouse Cloud.
• Sealed results encrypt an event with your project's key (AES-256-GCM), so the browser can't read or change it. We generate that key and hold it, since identify seals with it, and show it to you once: only holders of the project's key can open a sealed result.

Keys and secrets

• Secret keys are stored as a SHA-256 hash and shown in full only once, when created.
• Keys carry a prefix and a checksum, so leak scanners can find them and a typo is refused without a lookup.
• Webhooks are signed with a timestamp, so your server can reject forged and replayed calls. We keep the webhook secret in full, since we sign with it.

Less data by design

• The agent never reads WebRTC network addresses, and query strings and fragments never leave the browser.
• Flags and scores never go back to the browser. Zero trust mode hides the visitor ID from it too, and the agent then stores none.
• Page URLs and referrers are kept as origin and path, as their origin only, or not at all.

Retention and erasure

• Each project keeps events for 30 days, 1, 3 or 5 years, or until it deletes them, which is the default; expired events are removed automatically, usually within a day or two.
• One API call erases everything stored for one external ID, another everything for one device, its links to browsers and IPs included.
• Erasure doesn't reach the 90 day IP lookup cache, webhook deliveries (kept 30 days), records of failed jobs and errors (kept until we remove them) or backups (35 days).

Access to the dashboard

• Passwords are stored with scrypt, and every change to an account ends its sessions.
• Our own logins are checked with the service itself: a bad bot or an identification from another browser can't log in.
• An account only sees the projects it was given. There are no roles yet: every teammate can create keys, change settings, allow support access and delete the project. Two-factor authentication isn't offered yet.

Support access

• Our support staff can read a project's events, usage and keys only while the project allows it, for 12 hours at a time.
• Teammates grant it in the project's settings or by accepting a request, can end it at any time, and see a banner while support is looking.
• Every page support opens is recorded in the organization's audit log.

Compliance