SECURITY & PRIVACY ARCHITECTURE

Security by design, not by retrofit.

Zero cookies. Per-project API keys. No third-party data sharing. Your telemetry stays yours.

Start building with privacy

Zero Tracking Cookies Per-Project Scoped Keys Zero Data Resale

Security architecture illustration showing encrypted data flow from browser through API key authentication to storage, padlock and shield icons, privacy-first analytics, clean vector style with blue and white

Security principles.

Truthful, verifiable controls engineered into every layer of our stack.

sessionStorage · in-memory

Zero-cookie architecture

No persistent tracking cookies, no consent banners needed. Sessions persist temporarily in sessionStorage and are cleared upon tab closure.

Bearer token · cryptographic

Per-project API keys

Every ingestion and metrics request requires a valid Bearer token bound strictly to that project. Cross-project requests fail with 403.

Origin header check

CORS allowlist per project

Each project defines its own allowed_origins. Non-allowlisted origins are rejected at browser preflight. No wildcards in production.

Strict zero-sharing policy

No data resale

Tracabit never sells, aggregates, or trades visitor telemetry. Your telemetry is used solely for your product intelligence.

djb2 non-PII hash

Passive fingerprint

One-way hash over non-PII browser attributes (UA, language, screen, timezone). No cross-site or persistent device tracking.

CF-IPCountry / X-Vercel

Geo-IP via CDN headers

Country attribution resolved at the edge from CDN headers, never from raw client IP addresses stored in databases.

How your data flows.

A single authenticated pipeline: client to engine to isolated storage. Click any stage to inspect its security controls.

TLS 1.3 + Bearer Auth

POST /analytics

Encrypted ingress endpoint accepting event payloads. Authenticates caller project token and validates origin headers against CORS allowlist.

Enforced Security Controls

Per-project Bearer token authentication

Strict CORS preflight check against allowed_origins

Reject unauthenticated events with HTTP 401

Requests without a valid API key fail with 401. Requests using a key from another project fail with 403. Non-allowlisted origins never pass the browser preflight.

Per-project API-key authentication.

Every request carries a Bearer token bound to exactly one project. That token can never read another project's data, and unauthenticated requests are rejected immediately. No wildcards, no shared secrets, no cross-project leakage.

HTTP 200: Authenticated ingestion with valid project key

HTTP 401: Missing or malformed Bearer authorization token

HTTP 403: Token project scope mismatch (tenant isolation)

# 1. Authenticated ingestion request
curl -X POST https://your-host/analytics \
  -H "Authorization: Bearer tcb_live_prod_01" \
  -d '{"sessionId":"s1","event":"page_view"}'

HTTP/1.1 200 OK
{ "ok": true, "ts": 1786851600000 }

Our compliance path.

Transparent milestones for certifications, data residency, and enterprise governance.

Available Today

Shipped

Per-project API keys · per-origin CORS allowlists · zero-cookie sessions · non-PII passive djb2 fingerprinting · Tero ACID local storage.

In Progress

Active

Geo-IP resolution via CDN edge headers · internal cost and throughput dashboard · referrer & domain header validation.

Month 6

Roadmap

SOC-2 Type I audit kickoff with external assessor · Frankfurt EU data residency isolation cluster.

Month 9

Roadmap

SOC-2 Type I report delivery · VPC self-host deployments via Terraform & Helm · standard Data Protection Agreement (DPA) template.

Month 12

Roadmap

SOC-2 Type II attestation period · custom automated data retention policies · white-label embedded analytics.

Report a vulnerability.

Found a potential security issue? We take all reports seriously and adhere to responsible disclosure best practices.

Response SLA

< 48 hours

Direct engineer response

Bounty Program

Planned

Swag & bounty pool

Encryption

PGP Encrypted

PGP key available

[email protected]

Email security team

Build on a foundation of privacy.

Zero cookies. Per-project keys. No third-party data sharing.

No cookies. No third-party ad tracking. Your telemetry stays yours.