Security

Data isolation

Every account is a separate workspace. Projects, experiments, goals, API keys and results are scoped to your workspace at the query level, so one customer can never see another's data.

Encryption

All traffic — the dashboard, the API and the tracking snippet — is served over HTTPS/TLS. Passwords are stored using industry-standard bcrypt hashing, and sensitive fields such as two-factor secrets are encrypted at rest.

Authentication & access

• Session-based login for the dashboard, with optional two-factor authentication.
• Scoped API tokens (Sanctum) for programmatic access — revocable at any time.
• Per-domain tracking keys for the snippet, so tracking requests are authenticated to your project.
• Role-based workspace access (owner, admin, editor, viewer).

The tracking snippet

Our snippet only reads what it needs to run your experiments and record conversions. It does not collect passwords, form contents or any field you don't explicitly target, and it validates that requests originate from your verified domain.

Reporting a vulnerability

Found a security issue? We appreciate responsible disclosure. Please reach out via our contact page and we'll respond promptly.