Skip to content
Statsy
Sign inStart free trial

Last updated

Security

Analytics data tells a lot about a business. Here is how we look after it, and how to tell us if you find a problem.

The short version

  • TLS everywhere, integration secrets encrypted with AES-256-GCM, and backups encrypted before upload.
  • Databases have no public ports. Every API request is checked against its workspace and role.
  • Visitor IP addresses are never stored, raw events expire after three years at most, replays after 90 days, and replays mask every form input.
  • We never train AI models on your data, and no third party may.
  • Found a problem? Email support@statsy.co. We acknowledge within 3 business days.

1. How we protect Statsy

  • Encryption. TLS everywhere, HSTS on our domains, backups encrypted before upload, and integration secrets encrypted at rest with AES-256-GCM.
  • Accounts. Hashed passwords, email verification, rate-limited sign-in and reset, and every session revoked when a password is reset.
  • Isolation. Every API request is checked against the workspace and role it acts for. API tokens are stored only as hashes and can be limited to one site.
  • Infrastructure. Databases run on private networks with no public ports, and internal job endpoints are blocked at the edge. Client addresses are only trusted from verified proxy ranges, so rate limits cannot be dodged by forging headers.
  • Minimal data. Visitor IP addresses are never stored, replays mask form inputs, and analytics data is kept at most three years.
  • No AI training. We never train AI models on your data, and no subprocessor may. The optional weekly digest and the Ask panel send aggregated totals to a model to write a summary; nothing about individual visitors, and nothing is retained by the provider for training.
  • Replays and retention, stated. Session replays mask every form input in the browser before anything is sent, so passwords, card numbers and messages never reach us. Replays are deleted after 90 days and raw analytics after three years at most; everything goes 30 days after a plan ends.
  • Web protections. Strict security headers, no third-party scripts in the dashboard, and output escaping in emails and reports.

2. Reporting a vulnerability

If you find a security issue, email support@statsy.co with the steps to reproduce it. We will acknowledge within 3 business days, keep you updated, and credit you if you wish once it is fixed.

We will not take legal action against research that follows these rules:

  • Only test against accounts you own or have permission to use, and stop as soon as you reach someone else’s data.
  • Do not run denial-of-service, spam, social engineering or physical attacks, and do not degrade the service for others.
  • Give us reasonable time to fix the issue before telling anyone else.

Out of scope: missing best-practice headers without a working exploit, self-XSS, rate limits on non-sensitive endpoints, and reports from automated scanners with no demonstrated impact.

Security · Statsy