Security
Keeping your account and data safe
The best protection for visitor data is not collecting it in the first place. For everything we do store, here's how we look after it.
Minimal data by design
No cookies, no stored IP addresses and a visitor hash whose salt is destroyed daily. Even in the worst case there is no personal browsing history to expose.
Encrypted in transit
Every connection to the dashboard, API and tracking endpoint uses HTTPS.
Strong authentication
Passwords are hashed with bcrypt. Two-factor authentication with an authenticator app is available to everyone, and team owners can make it mandatory.
Session control
Sessions use secure, HTTP-only cookies and expire after inactivity. See every signed-in device in your settings and log any of them out.
Protection against abuse
Sign-in and password reset are rate-limited, state-changing requests are CSRF-protected, and API keys are stored only as hashes and shown once.
Least privilege
Viewer, editor, admin and billing roles for teams, plus guest access limited to a single site.
Hosted in the UK
Our application and databases run in a London data centre. Analytics data is kept in databases that aren't reachable from the public internet.
Your data, portable
Export everything as CSV at any time. Deleting a site or account permanently deletes its analytics data.
Reporting a vulnerability
If you believe you've found a security issue in PlainAnalytics, please email hello@plainwebanalytics.com with the details and steps to reproduce. Please give us a reasonable chance to fix it before disclosing it publicly. We don't take action against good-faith research.