How TraceLog protects access to your data
TraceLog separates each customer’s data and keeps raw events for ninety days.
Hosted in the EU
Events, daily totals and accounts stay in Frankfurt.
Nothing from the browser before consent
TraceLog waits for the visitor to accept, and sends nothing if they refuse. Where the server confirms the order, it still counts.
No GA4 or ad-account access
TraceLog never asks for access to GA4, Meta or Google Ads. Shopify uses app permissions; WooCommerce and PrestaShop connect with a pairing code. Stripe’s signing secret only proves a notice comes from Stripe: it gives no access to your account.
Public capture code
The SDK behind the snippet and the npm package is public on GitHub, under the MIT licence. Read the code.
What TraceLog keeps and what it leaves out
The conversion path you define, and the acquisition context that arrives with it.
Kept
- The sessions, steps and conversions it receives.
- Acquisition context for supported segment comparisons.
- Daily counts and the evidence behind alerts and findings.
Left out
- No session replay, screen recording, keystrokes or mouse movement.
- No stored IP addresses.
- A click identifier’s value (gclid, fbclid and the like) is dropped on arrival; only its name stays, to tell where the visit came from.
- No secrets, credentials or raw payloads in application logs.
Only these providers process data on TraceLog’s behalf
- Resend
- EU (sending), US (data)
- Global
- Anthropic
- United States
- Stripe
- United States
- Cloudflare
- Global
- Amazon Web Services
- EU (eu-central-1, Frankfurt)
Outside the region. Four optional operations send information outside the region: answering a question, signing in with Google, paying for a subscription through Stripe, and, for a person who arrived from a TraceLog ad and accepted advertising cookies, telling Google Ads that the click led to a sign-up or a demo request.
None of those providers. If a customer does not ask a question, sign in with Google, choose a paid plan, or accept those cookies, none of those providers receives their information.
Cloudflare. Creating an account with email and password is the one that is not optional: Cloudflare checks the person signing up from its global network, and receives no account data.
The complete detail. For the complete data and contractual detail, read Privacy and data, the list of subprocessors and the Data Processing Agreement.
Access is limited by account, credential, network and time
Account and project separation
Queries on a project’s data carry its identifier, and access paths are tested against reading another customer’s data. A client contact sees one project.
Credentials and temporary links
Passwords and server keys are stored so they cannot be read back. Secrets are shown once; temporary links are hashed and expire.
Network boundaries
Capture from the browser checks the project’s allowed origins. Sign-in, capture and sensitive queries have request limits.
Retention and operational access
Raw events are kept for ninety days; daily totals, without limit. Every operator read of an account records who and why.
Encryption, breaches and deletion
Data travels encrypted, and if there is a personal data breach, we notify you without undue delay. You can export or delete a project’s data, and report a vulnerability to info@tracelog.io.