Security

Last updated: [DATE]

Tenant isolation

Every account's data is scoped both in application code and by database row-level security, so a bug in one query cannot expose another account's data. The database role the application connects as cannot bypass this. An isolation test suite runs on every change.

Encryption

Google Analytics refresh tokens are encrypted at rest (AES-256-GCM) before storage; decryption is confined to the GA4 integration and tokens are never logged or sent to a model. Traffic to the Service is encrypted in transit.

What the collector never reads

The measurement script installed on a customer's site never reads keystrokes, input values, form contents, passwords, or payment data, structurally — not through a filter applied afterward.

Abuse and integrity controls

Rate limits apply per installation, IP, and account. Manifests that tell the collector what to measure are cryptographically signed and version-checked, so an injected or tampered manifest is rejected. Outbound requests made by our crawler are restricted from reaching private or internal network addresses.

Operational safeguards

Webhook requests from payment and identity providers are verified by signature before being trusted. Secrets are never committed to source control and never interpolated into logs, prompts, or error messages.

Reporting an issue

Please report a suspected security issue to [email protected].