# Privacy & Security Docs DocsPrivacy & Security [All docs](/docs) Get Started - [Overview](/docs/overview) - [How It Works](/docs/how-it-works) - [Your First Plan](/docs/your-first-plan) - [Post-Install Warm-Up](/docs/post-install-warm-up) - [Multi Account Management](/docs/multi-account-management) Install - [Installing Trackingplan](/docs/installing-trackingplan) - [For Websites](/docs/installing-trackingplan/installing-trackingplan-on-your-websites) - [CDN](/docs/installing-trackingplan/cdn) - [AEP](/docs/installing-trackingplan/adobe-experience-platform) - [Webhooks](/docs/installing-trackingplan/installing-trackingplan-using-webhooks) - [For Apps](/docs/installing-trackingplan/installing-trackingplan-in-your-apps) - [For ssGTM](/docs/installing-trackingplan/for-ssgtm) - [Environments](/docs/environments) - [SDK Update](/docs/sdk-update) The Agent - [Threads](/docs/threads) - [Reports](/docs/reports) - [Audits](/docs/audits) Use Cases - [Investigate a Warning](/docs/debug-warnings) - [For Analytics Teams](/docs/analytics-use-cases) - [For Performance & Paid Media](/docs/paid-media-use-cases) - [For Compliance & Legal](/docs/compliance-use-cases) - [For Agencies & Consultancies](/docs/agency-use-cases) Monitoring - [Warnings & Updates](/docs/warning-and-updates) - [Data Validation](/docs/data-validation) - [Data Layer Monitoring](/docs/data-layer-monitoring) - [Consent & Cookie Monitoring](/docs/consent-and-cookie-monitoring) - [Privacy Monitoring](/docs/data-privacy-monitoring) - [Pixel Monitoring](/docs/pixels-presence-monitoring) - [Naming Conventions Monitoring](/docs/naming-conventions-monitoring) - [Releases & GTM Monitoring](/docs/autodiscover-releases) Explore - [Explore](/docs/explore) - [Health Summary](/docs/health-summary) - [Data Explorer](/docs/data-explorer) - [Tracks Explorer](/docs/tracks-explorer) - [Presence Map](/docs/presence-map) - [Advanced Views](/docs/advanced-views) - [Session Finder](/docs/session-finder) - [Filters & Data Segmentation](/docs/attribution) - [Tags](/docs/tags) - [Notes & Labels](/docs/notes-labels) - [Starred Items](/docs/starred-items) - [Sharing](/docs/sharing) Your Trackingplan - [Destinations](/docs/destinations) - [Split Destinations](/docs/split-destinations) - [Events](/docs/events) - [Properties](/docs/properties) - [Attributes](/docs/user-attributes) - [Pages](/docs/pages) - [Compliance](/docs/compliance) - [Privacy](/docs/privacy) - [Consent](/docs/consent) - [Platform](/docs/platform) - [Daily Checks](/docs/daily-checks) - [Vitals](/docs/platform-metrics) - [Acquisition](/docs/acquisition) Connect - [Slack](/docs/slack) - [MCP Endpoint](/docs/mcp-endpoint) - [Ad Platforms](/docs/ad-platforms) - [Trackingplan Exploration API](/docs/trackingplan-exploration-api) - [Trackingplan Export API](/docs/trackingplan-export-api) - [Data Studio Connector](/docs/trackingplan-connector-for-data-studio) - [Chrome Extension](/docs/trackingplans-chrome-extension) - [Omnibug Extension](/docs/trackingplan-omnibug-extension) Account & Security - [Settings & Members](/docs/settings) - [Privacy & Security](/docs/privacy-and-security) - [JSON Export/Import](/docs/export-import-json-schemas) [Account & Security](/docs) Updated September 23, 2026 # Privacy & Security Learn how Trackingplan protects your data with advanced security, strict privacy controls, and full compliance with industry standards. > At Trackingplan, protecting personal data is not a feature—**it is a founding principle**. We build every component with the European tradition of strong privacy safeguards in mind and treat the GDPR as a starting point, not a finish line. > > Three core values guide our engineering decisions: **privacy by design**, ** security in depth** and ** transparent compliance**. We prevent personal data from leaving the user’s device thanks to advanced on‑device masking, operate on hardened cloud PaaS services, and define least‑privilege access so each service can do only what is strictly necessary. > > **We hold ourselves accountable** through rigorous peer review, continuous monitoring and an on‑call culture that responds to issues before they become incidents. > The pages that follow describe how these values translate into concrete safeguards. If you have questions, please reach out to [support@trackingplan.com](mailto:support@trackingplan.com)*.* **Our SDK forwards only anonymized events** required for anomaly detection and never collects more data than our clients already send to analytics providers. **Client data stays encrypted and isolated.** Running entirely on hardened cloud infrastructure in the EU — ** AWS (Frankfurt), ClickHouse Cloud (Frankfurt), Cloudflare's edge network, and Microsoft Azure for AI** — we encrypt data in transit and at rest, enforce least‑privilege access via granular IAM roles and resource-level permissions, and automatically delete end-user tracking data after 90 days. **People, process, and compliance are built‑in.** Every change is peer‑reviewed and CI/CD‑deployed; we enforce 2FA, audit logs, on‑call coverage, and 24/7 monitoring guard availability with automated escalation, while GDPR principles and our DPA establish legal obligations. **Trackingplan offer includes Privacy Audit.** It monitors your sites and apps for accidental private‑data leaks to other vendors. Watches outbound traffic, flags personal information sent to third‑party vendors, checks consent signals, and helps with compliance. ## Overview: how Trackingplan handles data *The Trackingplan SDK inspects only the requests client sites or apps already send to third‑party services, processes them locally, and forwards to our backend only the events—already anonymized—needed for anomaly detection.* - The SDK runs inside our clients’ users’ **browsers** and ** mobile apps**. - It observes **only the** ***requests*** ** that are already being sent** to third‑party services selected by our clients (e.g., Google Analytics, HubSpot, Mixpanel, Google Ads). - On the device, it parses those requests **locally** and applies anonymization or masking where necessary by default. - Only the **processed** and already anonymized events are sent to Trackingplan’s servers. - On our servers, the events are **parsed** and ** modeled**, then monitored for anomalies that may reveal ** implementation errors** by the client or third‑party tools. - A **web interface** lets our clients inspect the detected data schema, alerts, and sample events for *debugging*. ## On‑device anonymization and masking *Personal data is removed on the user’s device, so no identifying information leaves the origin.* - Trackingplan **identifies most private data** using a broad range of patterns and vendor‑specific rules. - Private fields are masked on‑device by default (e.g. `usePrivacy: true`), so **no personal data leaves the user’s device**. We use masking instead of hashing to avoid cross‑request user identification. - On-device masking is **enabled by default** in our SDK. Customers do not need to activate it, but they can ** extend or customize the PII rules** to match their specific use case. ## No extra data collection *Trackingplan sees only the data clients already share with other vendors and strips any extra identifiers.* - Even with masking turned off, the SDK transmits **only the data already sent to third‑party services**. - Trackingplan **does not** identify users. - It **does not** store data that could be used for identification or fingerprinting (e.g., IP addresses); these are stripped before processing. - The **Privacy Audit** feature highlights any private data being forwarded to third parties so clients can shut it off. ## Helps with PII and consent compliance *Trackingplan's Privacy Audit feature monitors accidental sharing of personal data with other third‑party vendors.* - Trackingplan is used by our clients to **audit the privacy compliance of their integrations with other vendors**. - It continuously scans every request and **flags any private data sent** to analytics, advertising or CRM vendors, pinpointing the exact field, page and destination. - It allows verifying that **no data is sent when users opt out** via Consent Mode or similar mechanisms and alerts whenever a vendor receives data that contravenes user choice. - It provides legal and DPO teams with **actionable evidence to stop the transfer of disallowed data** and restore compliance. ## Infrastructure and data security *Hosted on hardened cloud infrastructure in the EU, all data is encrypted in transit and at rest and end-user tracking data is retained for a maximum of 90 days under strict access controls.* - All data is **encrypted** in transit (TLS 1.2+). - All workloads run on hardened **AWS** accounts isolated by environment, and we favour managed ** Platform‑as‑a‑Service (PaaS)** offerings to reduce patching overhead and attack surface. - Stored data is encrypted with **AES‑256**. - All public endpoints are shielded by **AWS WAF behind Cloudflare's edge network,** which blocks common web‑layer attacks and abusive traffic. - Each component requires explicit, least‑privilege permissions—defined in **Terraform** —to communicate with any other component. - Our only sub-processors are **AWS, ClickHouse Cloud, Cloudflare, and Microsoft Azure**, all covered by signed DPAs. For an always-current official list, you can review our [external security audit](https://attest.comply.org/trackingplan/). - End-user tracking data (the captured traffic payloads and their metadata) is automatically deleted after **90 days**. The rest of your account's data, such as your plan's configuration and the threads, reports and audits you create with the AI agent, is kept until you delete it, you submit a deletion request, or your contract ends. ## Application security *Granular roles, strong authentication, and a self‑service deletion workflow keep customers in full control.* - Dashboards use a **role‑based** system (administrator, editor, viewer) that clients manage per workspace. - Users can enable **Two-Factor Authentication (2FA) in** their account settings to add an extra layer of protection to their login. We support email verification codes and authenticator apps. For organizations that prefer stricter security, we can enable 2FA for all user accounts [upon request](mailto:support@trackingplan.com). - Every access requires OAuth 2 authentication (AWS Cognito) and is accessible **only** by the customer; the Trackingplan team may obtain audited support access when requested. For the AI features, see [How we work with AI](#how-we-work-with-ai). - Clients can trigger **complete account deletion** at any time; after legal retention periods, all data is irreversibly wiped. - Sessions expire after inactivity and are protected against CSRF and *session‑fixation* attacks. - **SSO is available** for enterprise accounts. ## Process and team security *Every employee uses 2FA; access is logged, and a dedicated security team manages backups, compliance and security standards.* - Company‑wide **Two‑Factor Authentication** is enforced. - All staff receive **annual security training** and sign confidentiality agreements; access to production systems is logged via *audit logs*. - A dedicated **DevOps and Security** team oversees infrastructure, backups, and incident response and serves as the red team during penetration tests. - **Daily encrypted backups retained for 30 days**, plus ** continuous point-in-time recovery**. - **Each code change is peer‑reviewed**, automatically tested pre- and post-merge, deployed to staging, and monitored after production release. - When changes affect infrastructure, including new API endpoints, the DevOps and Security team performs an additional code review, test, and monitoring validation **before they reach production.** - **Monitoring and alerting run 24/7 with automated escalation**; incidents are handled by our on-call engineers under our support SLAs. ## GDPR compliance *Trackingplan meets all GDPR principles: data minimization, strong encryption, and clear processes for data‑subject rights and breach notifications.* Our **Data Processing Addendum (DPA) is part of our standard terms** and is publicly available at [https://attest.comply.org/dpa/trackingplan.pdf](https://attest.comply.org/dpa/trackingplan.pdf). - **Role and contract**: We act as a *processor,* and our DPA sets out the terms governing the processing of personal data on behalf of our clients. - **Lawfulness and purpose**: Data is processed solely to monitor implementations and detect anomalies; it is never resold or used for marketing. - **Minimization and retention**: Only the fields required for monitoring are processed, anonymized at source, and the end-user tracking data is automatically deleted after ** 90 days**. - **Security**: Encryption in transit (TLS 1.2+) and at rest (AES‑256), role‑based access and 2FA, EU/US data centers chosen by the client with ** SCCs** when needed. - **Rights and breaches**: We honor data‑subject requests and notify any breach within ** 72 hours**. ## How we work with AI *At Trackingplan, AI is designed to help you detect, understand, and resolve data quality issues more efficiently — without compromising data privacy, security, or control.* ### Where Trackingplan AI runs Trackingplan AI runs on **OpenAI models via Microsoft Azure AI Foundry (EU Data Zone)**, always inside the EU. - Your data is **not used to train third-party or external AI models**. - **Data is isolated across Trackingplan clients**, with no sharing or learning between them. ### What the AI agent reads The AI agent reads: - Your plan's **captured tracking data**: the same data you see in Trackingplan, with personal data masked on the device by default (see [On‑device anonymization and masking](#on-device-anonymization-and-masking)). - Your plan's **configuration**: its specs, warnings, settings and plan context. - What you **type or attach** in a conversation. It has no access to payment data or account credentials stored by Trackingplan. ### Other services the AI agent uses Two services support specific AI features. Neither receives your end-user tracking data: - **Web search:** when a question needs public information, such as a vendor's documentation, the AI agent can search the web through ** Microsoft Bing**. Only the search terms leave Trackingplan. - **Live site checks:** when you ask the agent to check your live site, it opens your public pages in a cloud browser from ** Browserbase**, in the region nearest to you (Frankfurt for Europe). It visits them as a new visitor would, and it receives none of your tracking data. ### Who can see your AI content Threads, reports and audits are visible to you and to the people you share them with. Authorized Trackingplan staff can also review AI conversations, reports and audits to provide support and improve answer quality; this access is limited to the team that operates the AI features. The feedback you send on an answer is reviewed for the same purpose. Threads, reports and audits are kept until you delete them, you submit a deletion request, or your contract ends. ### You decide where AI results go AI results leave Trackingplan only through channels you or your plan's admins turn on, and each of them can be turned off or revoked at any time: - **Public links** to threads and reports, readable without signing in, and the optional ** questions on a report's public link**, off by default, which let anyone with the link ask about the plan's data behind the report. - **Slack**, where the agent answers in your own workspace, and the ** MCP endpoint**, which your own IDEs connect to. - **Audit notifications** by email or to your Slack channel. ### Full control over AI features All AI features in Trackingplan are **optional**: plan admins can turn them on or off at any time from the [AI Features settings](/docs/settings#ai-features). ### Compliance and transparency The AI providers behind these features are publicly listed and kept up to date in Trackingplan's [External Vendor Audit](https://attest.comply.org/trackingplan/). We recommend reviewing the **Data Processing Agreement (DPA) you have signed with Trackingplan** to ensure it aligns with your company’s data protection, privacy, and compliance policies. ## Company profile *Independent, well‑funded, and trusted by global brands.* - Founded in **2021** by former Oracle, CaixaBank, and Google employees. - Backed by **tier‑1 investors** on both sides of the Atlantic, including ** K Fund, Y Combinator, and Nauta Capital**. - Over **200 companies** —from billion‑dollar enterprises to high‑growth startups—use Trackingplan in production. - Trackingplan operates through two legal entities to **comply with clients' regional regulations**: *Trackingplan, Inc.* in the US and *Trackingplan Europe S.L*. in the EU. [← Previous**Settings & Members**](/docs/settings) [Next →** Export/Import JSON Schemas**](/docs/export-import-json-schemas) Was this useful? Write to [support@trackingplan.com](mailto:support@trackingplan.com) On this page 1. [*01*Overview: how Trackingplan handles data](#overview-how-trackingplan-handles-data) 2. [*02*On‑device anonymization and masking](#on-device-anonymization-and-masking) 3. [*03*No extra data collection](#no-extra-data-collection) 4. [*04*Helps with PII and consent compliance](#helps-with-pii-and-consent-compliance) 5. [*05*Infrastructure and data security](#infrastructure-and-data-security) 6. [*06*Application security](#application-security) 7. [*07*Process and team security](#process-and-team-security) 8. [*08*GDPR compliance](#gdpr-compliance) 9. [*09*How we work with AI](#how-we-work-with-ai) 10. [*10*Company profile](#company-profile)