Security

Built so you can trust the numbers and the data

What we do with shopper data and your ad account credentials, in plain words.

Shopper data

Email, phone, name and street are normalized and SHA-256 hashed inside the ingestion service, before anything is queued or stored. Raw values are never written to the database or logs.
Only coarse geography (city, region, postal code, country) is kept unhashed, because Google requires it for matching.
Consent is recorded on every event: with ads consent denied, no ad cookies are set and nothing is delivered to ad platforms.
Raw event data is kept for the retention period you choose (default 30 days) and then removed.
Customer data requests: find and permanently erase everything held about one shopper (by email, phone, customer id or visitor id) from Settings. The erasure is recorded in the audit log without the shopper's details.

Access tokens for Meta, TikTok, GA4, Snapchat, Pinterest and ad accounts are encrypted with AES-256-GCM, bound to your store, and never shown again after you save them.
A token that a platform rejects pauses that destination; events wait instead of being retried until they are lost, and the store's owners and admins get one email about it.
Outbound connections only go to public internet addresses, checked on the addresses DNS actually returns, so a webhook URL can't reach internal systems. Webhooks are signed with HMAC-SHA256.
Secret API keys are shown once, stored as hashes, and refused if used from a web page.

Two-step sign-in with an authenticator app and recovery codes.
Roles (owner, admin, developer, analyst, viewer) enforced on every action; the last owner of an organization cannot be removed.
Invitations work once, expire after 7 days, and only for the address they were sent to.
The dashboard session is an encrypted, HTTP-only cookie; changing your password signs out every device.
Password reset links are single-use and expire after 30 minutes.

Every request is checked against the store it names; a store you do not belong to answers as if it did not exist.
Rate limits are per store, so one busy store cannot slow another.
Ingestion never waits for an ad platform: events are queued, delivered with retries and backoff, and each attempt is recorded for the debugger.

See also the privacy policy. Found a security issue? Email security@trakero.com.