Security
Where your data lives, how it's protected, and who can access it.
What we promise.
US-only identification
Person-level identification runs only after a US GeoIP gate. Non-US visitors stay analytics-only.
No fingerprinting
We don't fingerprint browsers or build cross-site profiles. First-party only.
Encrypted in transit and at rest
TLS on every endpoint. AES-256 on every managed datastore. US-region hosting.
Compliance, stated honestly
CCPA-compliant today with a public opt-out. SOC2 Type I targeted for 2026 Q4.
Common questions.
Security disclosure
Reach us through our contact form with the Security topic. We acknowledge within 24 hours and credit responsible disclosures on this page.