Security

What we do

• Encryption in transit. Every connection to the dashboard, the API and link domains uses TLS, and so does the connection to our database.
• Encryption at rest. Our database provider, MongoDB Atlas, encrypts stored data.
• Signed SDK requests. App SDKs sign each request with HMAC-SHA256 and a timestamp. Server keys are shown once, kept on your servers, and can be revoked at any time.
• Least data. We never store raw IP addresses: we keep a hash made with a daily salt, and delete the salt after 9 days. Emails and phone numbers passed to identify are hashed on the device. No advertising ids, contacts or precise location.
• Automatic deletion. Clicks after 30 days, website sessions and events after 90 days, app events after 13 months.
• Access control. Each brand sees only its own data, and team members have roles. Access to production is limited to the people who need it.
• Audit log. Changes to apps, keys, domains and funnels are recorded with who made them, in Settings → Change history.
• Hardened website. This site sends HSTS, blocks framing and limits browser features such as camera and location.

Report a vulnerability

Email [email protected] with the steps to reproduce it. Please give us a reasonable time to fix it before telling anyone else, and don't access other people's data, degrade the service or use social engineering while testing. We'll reply, keep you posted and credit you if you'd like. Our security.txt has the same details.

If something goes wrong

If a breach affects your data, we tell you without undue delay and within 48 hours of becoming aware of it, with what we know and what we're doing about it.