Security at Trakily

• Trakily is hosted with DigitalOcean in the United States. All account, analytics and revenue data is stored there, in a database that we run and manage ourselves.
• The database isn't reachable from the internet. Only Trakily's own services can connect to it.
• The database and its backups are stored on DigitalOcean infrastructure in the United States.
• trakily.com, the tracking script, the event endpoint and the API are served over HTTPS only. Managed proxy subdomains you point at us (such as stats.yoursite.com) get their own certificate, and only after we've checked that the DNS record really points to Trakily.
• Visitor locations come from an IP-to-location database on our own servers, so no third party receives your visitors' IP addresses for that.

The vendors that help us run the service (hosting, email delivery, payments) are listed on the Subprocessors page.

Secrets you give Trakily are encrypted with AES-256-GCM (authenticated encryption, a fresh random IV for every value) before they are written to the database. The 256-bit key is held in the server's environment, not in the database, so a copy of the database alone can't decrypt them. This covers:

• payment provider API keys and webhook signing secrets (Stripe, Polar, Lemon Squeezy, Paddle, Dodo Payments, Razorpay);
• Google refresh tokens for Search Console and the Google Analytics import, and Facebook access tokens for Meta Ads;
• Slack and Discord alert webhook URLs, and the secret for AI crawler log drains;
• affiliate payout details.

Some things are never stored in a form that can be read back. Passwords are hashed with scrypt by Better Auth, our authentication library. Trakily API keys are stored only as a SHA-256 hash; we show you the key once, when you create it. Passkeys store only a public key. The secret for your authenticator app and your backup codes are stored encrypted.

• Two-factor authentication with any authenticator app, plus 10 single-use backup codes for when your phone isn't around. Once it's on, password and Google sign-ins both ask for the code.
• Passkeys: sign in with your fingerprint, Face ID, Windows Hello, a security key or a password manager. A passkey only works on trakily.com, so it can't be phished.
• Throttling. Sign-in attempts are rate-limited per network. A sign-in waiting for its code expires after 10 minutes or 5 wrong codes, and code sign-in pauses after 10 wrong codes in a row. Two-factor codes, passkey sign-ins and password reset requests have their own limits, stored in the database so they hold across restarts.
• Email alerts. We email you when two-factor authentication is turned on or off, backup codes are replaced, a passkey is added or removed, or your password is reset. Changing a verified email address has to be approved from the old address first.
• Sessions. Account settings → Sessions lists every signed-in device, and you can sign any of them out. A password reset signs out every session.

How to set these up: Security: 2FA and passkeys.

When the Trakily script sends an event, our server reads the visitor's IP address in memory to look up an approximate location (country, region, city), to apply flood protection, and to check the IP addresses you've chosen to ignore. The IP address is then discarded. It is never stored with the event and doesn't appear in exports or the API.

The script uses first-party cookies on your own domain (a visitor id and a session id) so that a payment made days later can be credited to the visit that brought the customer. There's no cross-site tracking, we don't build advertising profiles, and visitor data is never sold. If you switch a website to the cookieless script instead, the IP address also goes into a one-way hash with a salt that changes every day and is then deleted, so the hash can't be traced back or linked across days. Details are in the Cookie Policy.

Your team

Roles are set per website, and every request is checked on the server. People without access to a website get a "not found", so they can't even tell it exists. Share links and widgets are read-only and can be turned off at any time.

API keys

API keys belong to one website, are created by its owners, are either read-only or read and write, and can be revoked at any time. Each key is limited to 120 requests a minute.

Trakily staff

Only a short list of named staff accounts can open our internal admin tools, and only from a session that was signed in with a passkey or a two-factor code; a password alone isn't enough. Every change staff make, and every time they open a customer's dashboard (which is read-only), is written to an audit log. We look at your account only to provide the service, for support you've asked for, or when the law requires it.

The database is backed up every night. Each backup is kept for 14 days and then deleted, so data you delete is gone from backups within 14 days too.

Trakily subscriptions are sold through Dodo Payments, our Merchant of Record. You pay on Dodo Payments' checkout, so your card details never reach our servers. Webhooks from Dodo Payments are accepted only with a valid signature.

You can download a website's data as CSV and your account data as JSON at any time (Exporting your data). You can delete a website, an integration or your whole account yourself; the Data deletion instructions explain each option and what we keep.

If you think you've found a security problem in Trakily, please email [email protected] with "Security" in the subject. It helps if you include:

• what the issue is and what an attacker could do with it;
• the URL or part of the product affected;
• steps to reproduce it, and a proof of concept if you have one;
• how you'd like to be credited, if at all.

We'll confirm we've received your report within 3 working days, keep you updated while we fix it, and tell you when it's resolved. Please give us a reasonable time to fix the issue before you share it publicly.

Safe harbour

If you act in good faith and follow this page, we won't take legal action against you or report you to the authorities for your research. Good faith means you:

• only test against your own account and websites, or ones you have permission to test;
• don't access, change or keep other people's data beyond the minimum needed to show the problem, and delete anything you did access;
• don't degrade the service for others: no denial-of-service, spam or heavy automated scanning;
• don't use social engineering, phishing or physical attacks against our team or customers.

We don't run a paid bug bounty. Our contact details are also published in /.well-known/security.txt.

Trakily is a small team and doesn't hold SOC 2, ISO 27001 or similar certifications. We'd rather tell you exactly what we do, as on this page, than point to a badge. If that changes, we'll say so here. For how we handle personal data, see the Privacy Policy and, for customers, the Data Processing Agreement (questions about either: email us).