Feature

Privacy built into the pipeline, not bolted on after

Four controls do most of the work. Each one is a decision in the code, not a setting you have to remember to turn on.

The salt dies every day.

Each project has its own hashing key in Redis with a 24-hour TTL, never persisted and never included in a backup. When it expires, the previous day’s identifiers become permanently unlinkable to any IP address, which is what makes this anonymisation rather than pseudonymisation.

Raw IP has no column to sit in.

The IP address exists in memory for the length of one request, long enough to resolve a country and compute the salted hash, then it is gone. It is never written to a database, a log line, an error report or a trace.

Bots are labelled, not silently dropped.

Detected bot traffic is stored and marked as such rather than discarded, so you can inspect what was filtered. It is excluded from every report and, separately, it is never billed.

Deletion writes a receipt.

Every deletion, whether from retention ageing out or a subject request, records row counts before and after in a table you can read, verified by a follow-up count rather than assumed to have worked.

The supporting controls

· Because the salt is per project, the same visitor on two different customers’ sites produces two unrelated hashes. Cross-customer tracking is not something we promise not to do; there is no shared key that could do it.
· Query strings pass an allowlist (utm_*, ref, click-id presence) rather than a blocklist, so a token or an email in a URL is never received in the first place.
· Identifier-shaped URL segments are masked before storage, so /users/12345/profile is stored as /users/:id/profile.
· Geo resolves to country, not city, unless raised. Screen size is bucketed, browser version is major-only, and the raw user-agent string is discarded after parsing.

None of this makes your organisation GDPR compliant, and we will not tell you otherwise. We are a processor. Compliance is a property of your legal basis and your notices, not of a tool you installed. What we can give you is an accurate description of what the system does and the evidence your counsel will ask for.

Full detail for a vendor questionnaire: Privacy and Security.