Security — Vitrus

What we collect

Per event: the page path and query string, a referrer, page title, screen size, browser language, a coarse device/OS/browser bucket, a country code if your proxy provides one, and any properties you explicitly attach to a custom event.

What we never collect

No cookies and no stored identifier. The visitor id is a one-way hash with a salt that rotates daily; it cannot be reversed or joined across days.
No raw IP addresses. The IP is an input to that hash and is never written to disk. IPv6 is reduced to its /64 network prefix first.
No form values. Form abandonment reports the field name. Password and hidden inputs are ignored entirely.
No stack traces. Error tracking sends message, file and line — stack traces carry user data too often to be worth it.
No session recording. Not a roadmap item. Recording a screen means recording the ID number someone typed into your form.

Tenant isolation

Access is resolved before any metric runs, not filtered afterwards. Every query carries the site id as a bound parameter, and a site you cannot reach returns 404 rather than 403 — a 403 would confirm that the site exists.

This is enforced by a build gate (gate:tenant-leak) that fails CI if a query can reach the events table without a resolved site id. Isolation is a test, not a convention.

Application security

Parameterised SQL everywhere. Even user-defined funnels: step values always travel as bound parameters, and only the step count and type (from a fixed union) shape the query.
Zero runtime dependencies in the core. A gate fails the build if one is added. No transitive dependency tree means no transitive supply-chain surface.
No third-party scripts. The dashboard loads nothing from a CDN, so no external party learns which sites you look at.
Sessions. HTTP-only, secure, SameSite cookies. OAuth account linking requires a verified email from the provider.
Webhook signatures. Billing webhooks are verified by HMAC over the raw body before anything is parsed.

Data location and retention

Cloud data is stored in the EU. Retention follows your plan and old events are deleted, not archived. Self-hosting means no data reaches us at all — including the optional AI summary, which can run against a local model.

Sub-processors

Kept deliberately short: Hetzner (hosting, Germany), Paddle (payments, merchant of record), Resend (transactional email). If you enable an LLM provider with your own key, that provider becomes a sub-processor of yours, not of ours — and what reaches it is an aggregated evidence bundle, never raw visitor data.

Reporting a vulnerability

Email [email protected]. Please include enough detail to reproduce. We will confirm within three working days, and we will not pursue anyone acting in good faith. The core is open source — you are welcome to read it before you trust it.

Related: Privacy policy · DPA · GDPR / KVKK

How Vitrus is built and operated