Privacy and Security

Privacy and Security

Privacy and Security

At Trackingplan, protecting personal data is not a feature—it is a founding principle. We build every component with the European tradition of strong privacy safeguards in mind and treat the GDPR as a starting point, not a finish line. Three core values guide our engineering decisions: privacy by design, security in depth and transparent compliance. We prevent personal data from leaving the user’s device thanks to advanced on‑device masking, operate exclusively on hardened AWS PaaS services, and define least‑privilege access so each service can do only what is strictly necessary. We hold ourselves accountable through rigorous peer review, continuous monitoring and an on‑call culture that responds to issues before they become incidents. The pages that follow describe how these values translate into concrete safeguards. If you have questions, please reach out to support@trackingplan.com.

Our SDK forwards only anonymized events required for anomaly detection and never collects more data than our clients already send to analytics providers.

Client data stays encrypted and isolated. Running entirely on hardened cloud infrastructure in the EU — AWS (Frankfurt), ClickHouse Cloud (Frankfurt), Cloudflare's edge network, and Microsoft Azure for AI — we encrypt data in transit and at rest, enforce least‑privilege access via granular IAM roles and resource-level permissions, and automatically destroy customer data after 90 days

People, process, and compliance are built‑in. Every change is peer‑reviewed and CI/CD‑deployed; we enforce 2FA, audit logs, on‑call coverage, and 24/7 monitoring guard availability with automated escalation, while GDPR principles and our DPA establish legal obligations.

Trackingplan offer includes Privacy Audit. It monitors your sites and apps for accidental private‑data leaks to other vendors. Watches outbound traffic, flags personal information sent to third‑party vendors, checks consent signals, and helps with compliance.

Overview: how Trackingplan handles data

The Trackingplan SDK inspects only the requests client sites or apps already send to third‑party services, processes them locally, and forwards to our backend only the events—already anonymized—needed for anomaly detection.

  • The SDK runs inside our clients’ users’ browsers and mobile apps.
  • It observes only the requests that are already being sent to third‑party services selected by our clients (e.g., Google Analytics, HubSpot, Mixpanel, Google Ads).
  • On the device, it parses those requests locally and applies anonymization or masking where necessary by default.
  • Only the processed and already anonymized events are sent to Trackingplan’s servers.
  • On our servers, the events are parsed and modeled, then monitored for anomalies that may reveal implementation errors by the client or third‑party tools.
  • A web interface lets our clients inspect the detected data schema, alerts, and sample events for debugging.

On‑device anonymization and masking

Personal data is removed on the user’s device, so no identifying information leaves the origin.

  • Trackingplan identifies most private data using a broad range of patterns and vendor‑specific rules.
  • Private fields are masked on‑device by default (e.g. usePrivacy: true), so no personal data leaves the user’s device. We use masking instead of hashing to avoid cross‑request user identification.
  • On-device masking is enabled by default in our SDK. Customers do not need to activate it, but they can extend or customize the PII rules to match their specific use case.

No extra data collection

Trackingplan sees only the data clients already share with other vendors and strips any extra identifiers.

  • Even with masking turned off, the SDK transmits only the data already sent to third‑party services.
  • Trackingplan does not identify users.
  • It does not store data that could be used for identification or fingerprinting (e.g., IP addresses); these are stripped before processing.
  • The Privacy Audit feature highlights any private data being forwarded to third parties so clients can shut it off.

Helps with PII and consent compliance

Trackingplan's Privacy Audit feature monitors accidental sharing of personal data with other third‑party vendors.

  • Trackingplan is used by our clients to audit the privacy compliance of their integrations with other vendors.
  • It continuously scans every request and flags any private data sent to analytics, advertising or CRM vendors, pinpointing the exact field, page and destination.
  • It allows verifying that no data is sent when users opt out via Consent Mode or similar mechanisms and alerts whenever a vendor receives data that contravenes user choice.
  • It provides legal and DPO teams with actionable evidence to stop the transfer of disallowed data and restore compliance.

Infrastructure and data security

Hosted on hardened cloud infrastructure in the EU, all data is encrypted in transit and at rest and retained for a maximum of 90 days under strict access controls.

  • All data is encrypted in transit (TLS 1.2+).
  • All workloads run on hardened AWS accounts isolated by environment, and we favour managed Platform‑as‑a‑Service (PaaS) offerings to reduce patching overhead and attack surface.
  • Stored data is encrypted with AES‑256.
  • All public endpoints are shielded by AWS WAF behind Cloudflare's edge network, which blocks common web‑layer attacks and abusive traffic.
  • Each component requires explicit, least‑privilege permissions—defined in Terraform—to communicate with any other component.
  • Our only sub-processors are AWS, ClickHouse Cloud, Cloudflare, and Microsoft Azure, all covered by signed DPAs. For an always-current official list, you can review our external security audit.
  • Customer data is automatically deleted after 90 days.

Application security

Granular roles, strong authentication, and a self‑service deletion workflow keep customers in full control.

  • Dashboards use a role‑based system (administrator, editor, viewer) that clients manage per workspace.
  • Users can enable Two-Factor Authentication (2FA) in their account settings to add an extra layer of protection to their login. We support email verification codes and authenticator apps. For organizations that prefer stricter security, we can enable 2FA for all user accounts upon request.
  • Every access requires OAuth 2 authentication (AWS Cognito) and is accessible only by the customer; the Trackingplan team may obtain audited support access when requested.
  • Clients can trigger complete account deletion at any time; after legal retention periods, all data is irreversibly wiped.
  • Sessions expire after inactivity and are protected against CSRF and session‑fixation attacks.
  • SSO is available for enterprise accounts.

Process and team security

Every employee uses 2FA; access is logged, and a dedicated security team manages backups, compliance and security standards.

  • Company‑wide Two‑Factor Authentication is enforced.
  • All staff receive annual security training and sign confidentiality agreements; access to production systems is logged via audit logs.
  • A dedicated DevOps and Security team oversees infrastructure, backups, and incident response and serves as the red team during penetration tests.
  • Daily encrypted backups retained for 30 days, plus continuous point-in-time recovery.
  • Each code change is peer‑reviewed, automatically tested pre- and post-merge, deployed to staging, and monitored after production release.
  • When changes affect infrastructure, including new API endpoints, the DevOps and Security team performs an additional code review, test, and monitoring validation before they reach production.
  • Monitoring and alerting run 24/7 with automated escalation; incidents are handled by our on-call engineers under our support SLAs.

GDPR compliance

Trackingplan meets all GDPR principles: data minimization, strong encryption, and clear processes for data‑subject rights and breach notifications. Our Data Processing Addendum (DPA) is part of our standard terms and is publicly available at https://attest.comply.org/dpa/trackingplan.pdf.

  • Role and contract: We act as a processor, and our DPA sets out the terms governing the processing of personal data on behalf of our clients.
  • Lawfulness and purpose: Data is processed solely to monitor implementations and detect anomalies; it is never resold or used for marketing.
  • Minimization and retention: Only the fields required for monitoring are processed, anonymized at source, and automatically deleted after 90 days.
  • Security: Encryption in transit (TLS 1.2+) and at rest (AES‑256), role‑based access and 2FA, EU/US data centers chosen by the client with SCCs when needed.
  • Rights and breaches: We honor data‑subject requests and notify any breach within 72 hours.

How we work with AI

At Trackingplan, AI is designed to help you detect, understand, and resolve data quality issues more efficiently — without compromising data privacy, security, or control.

Where Trackingplan AI runs

Trackingplan AI runs on Anthropic Claude via AWS Bedrock and OpenAI models via Azure OpenAI (EU data zone) — always inside the EU. Customer data is never used to train AI models.

  • Data is not used to train third-party or external AI models.
  • Data is isolated across Trackingplan clients, with no sharing or learning between them.

Minimal and privacy-first data usage

Trackingplan AI features are built following a data minimization principle.

  • AI features only use the strictly necessary technical data required to function.
  • As Trackingplan filters PII at the client-side, personal data is not processed by AI features.

For example, Trackingplan’s AI Debugger processes:

  • Warning information
  • Warning appearance history
  • Statistics about random payload samples that led to the warning

Full control over AI features

All AI features in Trackingplan are optional:

  • You can enable or disable AI features at any time from the AI Features settings.
  • A global switch allows you to turn off all AI functionality instantly.

If your organization requires stricter governance, you can request a permanent, non-switchable ban on all AI features for your plan. Contact Trackingplan Support, and we will enforce it at the plan level.

Compliance and transparency

While Trackingplan’s approach to AI is secure by design, privacy-first, and always under your control, we recommend reviewing the Data Processing Agreement (DPA) you have signed with Trackingplan to ensure it aligns with your company’s data protection, privacy, and compliance policies.

Company profile

Independent, well‑funded, and trusted by global brands.

  • Founded in 2021 by former Oracle, CaixaBank, and Google employees.
  • Backed by tier‑1 investors on both sides of the Atlantic, including K Fund, Y Combinator, and Nauta Capital.
  • Over 200 companies—from billion‑dollar enterprises to high‑growth startups—use Trackingplan in production.
  • Trackingplan operates through two legal entities to comply with clients' regional regulations: Trackingplan, Inc. in the US and Trackingplan Europe S.L. in the EU.