Security & Compliance — Server Side Support

Client VPSes run in Amsterdam (UpCloud, nl-ams1) by default — or in one of 11 other UpCloud locations you choose (EU, UK, US, Singapore, Australia)
GTM server containers 100% within the EU with an EU location
Dashboard on Google Cloud Run in europe-west1 (Belgium)
No data transfer outside the EU without an explicit client choice (e.g. Meta CAPI to Meta)

Login via Google OAuth (SSO with the client's own Google account)
Multi-user per client with a primary-owner role for provisioning
Admin endpoints IAM-gated on Cloud Run (service-account-only)
No passwords stored → no credential-leak risk
OAuth callback with CSRF protection via a signed state cookie (login-CSRF mitigation)

Three moments, always the minimum: signing in (identity only: openid, email, profile) → linking when you start your setup (Tag Manager and Analytics) → data sources (Google Ads, BigQuery, Search Console) only when you connect them yourself
No refresh token (access_type=online): the access token is held in a secure session cookie that scripts cannot read, lasts 24 hours at most and is not in our database
Changes to your GTM container are made by our service account; on your GA4 property we only add a Viewer link, and only when you activate the event breakdown
Google Ads offers a single permission (“view and manage”); we use it for read queries only. BigQuery and Search Console are read-only
Data from those sources is fetched per question and not stored
Revoking: overview in the dashboard, revoke at Google (myaccount.google.com/permissions)
Our use of Google data adheres to the Google API Services User Data Policy, including Limited Use — see the privacy statement

Live event payloads are not logged persistently
Only aggregated request volume in the client dashboard
No personal data of your website visitors in our own systems; with the Advanced Data Keeper it stays on your own server
The public tracking scanner stores only cookie names from scanned sites — no values or content. The scan report expires automatically after 24 hours; we keep the name of the scanned domain so we know which sites use the checker (no cookie contents, no visitor data).
Enhanced Matching & CAPI: SHA-256 hashing server-side before transmission
First-party cookies on the client domain, no cross-site tracking
GA4 Data API reads via our service account (Viewer role only on the client property). From the client's GA4 we store only aggregate event counts per event name — no user IDs, amounts or session details. All Google permissions are listed in the privacy statement.

Unattended upgrades on every VPS (auto-patch Ubuntu)
fail2ban active on the SSH port
Self-heal systemd timer restores containers on boot issues
Rate limiting on all public endpoints
Idempotent webhooks via atomic claims (Firestore transactions)
HTTP security headers on all public services: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy
Server-side request forgery (SSRF) mitigation on the public scanner: outbound requests are resolved against an IP blocklist (loopback, private, link-local, cloud-metadata)
nginx regex allowlist on user-input query parameters (click-ID endpoints) — no cookie-attribute-injection vector

Our role: data processor (the client is the controller)
Advanced Data Keeper (add-on): data the client stores itself via its server container lives on the client's VPS, with a mandatory retention period (30 days by default, 400 at most) and deletion via the dashboard. We use only counts and storage size from it; for that data the client is the controller and we are the processor
DPA (Data Processing Agreement) available on request
EU data residency guaranteed for our own infrastructure
Right to erasure: via the dashboard or email within 30 days
Breach notification: within 72 hours per GDPR art. 33

Security & Compliance — transparent, isolated per client