Security Overview
Data residency & encryption
• Customer log data is stored in the United Kingdom (London), with retention governed by your plan and our data-processing terms.
• Ingestion endpoints and APIs use encrypted connections.
• Primary databases and archive storage use encryption at rest. The database's automated backups are also encrypted.
Access control
• Production access is restricted to authorised operators.
• Service permissions are assigned according to operational need.
• Customer API keys are stored as cryptographic hashes.
• Stored Google integration refresh tokens and Kinsta API keys are encrypted.
• Log ingestion requires credentials scoped to the relevant website.
Customer data separation
Access to customer reports and data is restricted to the authenticated organisation. Published aggregate statistics do not identify individual customers or visitors.
Resilience & recovery
• Primary data stores have recovery and deletion-protection controls.
• Managed storage services provide redundancy.
• Operational activity is logged to support monitoring and investigation.
Development & operations
• Software changes are version-controlled and reviewed.
• Automated deployment pipelines use temporary access credentials.
• Health checks and monitoring help us detect service issues.
Breach response
We notify affected customers without undue delay, and in any event within 48 hours of becoming aware, of a personal-data breach affecting their data, with enough detail for the customer's own regulatory assessment (GDPR Arts. 33–34).
What we don't claim
We do not currently hold SOC 2 or ISO 27001 certification. The measures described here are operational controls, not a certification claim.