Security and data handling
This page states plainly what we do. We do not currently hold SOC 2, ISO 27001 or HIPAA certification, and we make no claim to. The service runs in a single region.
Traffic and keys
- The public API and the website are served over HTTPS.
- Traffic between our own servers runs over a private WireGuard network.
- Secret keys are shown once when created or rotated and belong on your backend only. Publishable keys can only identify.
- Native hardware identifiers and your user IDs are stored only as keyed hashes.
Where the service runs
The service runs in a single region on servers we rent from Hetzner, behind Cloudflare. There is no choice of region and no separate EU, US or Asia deployment. If data residency in a particular region is a requirement for you, this service is not the right fit today.
Admin plane is not public
The administrative and console interfaces of the API are reachable only over our private WireGuard network and answer 404 on public hosts.
What we keep, and for how long
- Browser device records: 180 days after the device was last seen.
- Events (each identify, with its signals): 7 to 90 days, set per project in the console.
- Referral device bindings: 180 days after last seen.
- Feedback labels: 180 days.
- Records of denied requests: 90 days.
- Daily trust-signal records per visitor: 90 days.
- Anonymous quota usage records: 8 days.
- Claim records are kept until deleted, because they are what enforces one claim per device and email.
- Account and billing records are kept for as long as the account exists.
- Contact form messages are kept until we delete them.
Deletion on request
Deletion under GDPR is available on request. Contact us with the email address concerned and we delete the claims and related device records linked to it. We can also delete the referral bindings of one of your users.
What we do not claim
No SOC 2, ISO 27001, HIPAA or PCI certification. Card payments are handled by Stripe, and we never see card numbers. If you need a security questionnaire answered, contact us.
Report a vulnerability
Use the contact form with the topic Security. We read these messages ourselves.
Frequently asked questions
Can another customer see my claims?
No. Claims, limits and quotas are counted per project. They are counted across projects only when you put your own projects in one claim group.
Is the data encrypted at rest?
We do not publish a claim about storage encryption on this page. Ask us and we will answer for the current setup.
Talk to us about your use case
Tell us what you give away and how it gets abused. We answer from a real mailbox, not a bot.