How does Trackingplan handle the data it receives when customers use Trackingplan?

At Trackingplan, we are committed to full transparency in how we handle data and protect user privacy. Our platform is designed with privacy, security, and compliance at its core, ensuring that our clients maintain complete control over their data while meeting the strictest privacy regulations.

The Trackingplan SDK only observes the network requests your site or app already sends to third-party services—such as Google Analytics, HubSpot, Mixpanel, or Google Ads. These requests are parsed locally within the user’s browser or mobile app, where any necessary anonymization or masking is applied according to your configuration. Only processed, anonymized events—never raw or identifiable data—are forwarded to Trackingplan’s backend, strictly for anomaly detection purposes.

Client data remains fully encrypted and logically isolated at all times. Our infrastructure runs on hardened AWS PaaS services, with encryption enforced both in transit and at rest. Fine-grained IAM roles and resource-level permissions ensure strict access control, while all customer data is automatically deleted after 90 days by default.

Security is not just technical—it’s built into our processes. Every code change is peer-reviewed and deployed via CI/CD pipelines. Our team enforces two-factor authentication (2FA), maintains detailed audit logs, and ensures 24/7 system monitoring with on-call coverage to guarantee availability. GDPR principles are embedded into our design, and we offer optional Data Processing Agreements (DPAs) to support legal and regulatory compliance.

Through Trackingplan’s web interface, clients can inspect data schemas, review alerts, and analyze sample events in real time—empowering teams to debug implementation issues and safeguard data quality, without ever compromising user privacy.

For a complete overview of our privacy and security measures, please visit our Privacy & Security documentation.