Track
Start free

Security

Security

How Track protects customer data: architecture, controls and the guarantees you can verify in the product.

Last updated: 2026-09-03

Where data is protected on its way

From the first request to the delivery, every hop has a control: origin checks, rate limits and HMAC signatures at the collector, a durable queue, the consent policy before any routing, and workers with retries, circuit breakers and a dead-letter queue. Kill switches stop a site or an organization within seconds.

Where data is protected on its waySigned configuration reaches the browser, events reach the collector, and only events that pass the policy reach a destination. Vendor credentials leave the vault only inside the worker.Signed configEd25519 · fail closedWebsiteCollectororigin · rate limit · HMACQueuedurablePolicy✓Workerretries · breaker · DLQDestinationKill switchVaultKMS envelope
Signed configuration reaches the browser, events reach the collector, and only events that pass the policy reach a destination. Vendor credentials leave the vault only inside the worker.
On this page

Tenant isolation

Every tenant table carries the organization id and PostgreSQL row-level security is enforced for the application role. The worker role bypasses RLS only for the partitioned event store and audit trail, never for tenant configuration.

Secrets

Vendor credentials are encrypted with envelope encryption (AES-256-GCM data keys wrapped by AWS KMS or a local master key). The assistant, the browser and the logs only ever see a reference and the last four characters.

Signed configuration

Configuration bundles are immutable, versioned and Ed25519-signed. The browser SDK verifies the signature with WebCrypto before applying a configuration and rejects everything else (fail closed).

Data plane

The collector validates origins, applies rate limits and HMAC-signed server requests and hands events to a durable queue before answering. Workers process with retries, circuit breakers and a dead-letter queue. Kill switches stop collection and delivery per site or organization within seconds.

  • No fingerprinting, no cross-site identity
  • PII scanner blocks personal data in event properties before storage
  • IP addresses are truncated on ingest
  • Append-only audit log and usage ledger (database triggers)

Access and operations

Role-based access control with six organization roles, MFA and passkeys, break-glass access with mandatory reason and audit entry, retention jobs per data kind, and a vulnerability disclosure contact published on this page.

Controls at a glance

Each control is described in the sections above; this table is the short version.

Controls at a glance
ControlScopeMechanism
Tenant isolationEvery tenant table, application roleOrganization id on every row, PostgreSQL row-level security enforced
Secret storageVendor credentialsEnvelope encryption (AES-256-GCM data keys wrapped by AWS KMS or a local master key); only a reference and the last four characters are visible
Signed configurationBrowser SDKImmutable, versioned, Ed25519-signed bundles verified with WebCrypto; fail closed
Ingest protectionCollectorOrigin validation, rate limits, HMAC-signed server requests, durable queue before the response
DeliveryWorkersRetries, circuit breakers and a dead-letter queue
Kill switchesPer site or organizationStop collection and delivery within seconds
Data minimisationEvent properties, IP addressesPII scanner blocks personal data before storage; IPs truncated on ingest; no fingerprinting
AuditAudit log, usage ledgerAppend-only through database triggers
AccessOrganization membersSix roles, MFA and passkeys, break-glass access with mandatory reason and audit entry

Report a vulnerability

Please report vulnerabilities responsibly to support@track.site. We acknowledge within two business days and never name reporters without consent.