CookieCrumbs
Start free

docs · workspace

Security & data

Everything runs in Frankfurt, consent records are built to be proven rather than trusted, and the things we do not store are as deliberate as the things we do.

Where your data lives

Recording, serving your banner, the database, file storage and backups all run in eu-central-1 (Frankfurt). Consent data does not leave the EU.

What a consent record does not contain

No IP address, no user agent, no page URL is ever stored beside a consent record. A record holds the choice, the categories, the banner version and texts hash, the language, the regime and a pseudonymous visitor ID. Server logs are kept for at most 30 days.

Proof, not trust

  • Hash chain: each record is chained to the one before it, so any tampering is visible. The dashboard can verify a chain on demand.
  • Signed exports: proof exports are signed with Ed25519. Every download carries the content hash, the signature and the key ID, so a third party can verify a file without trusting us.
  • Key rotation: rotating the signing key introduces a new key ID; old public keys remain published so already-issued exports stay verifiable forever.
  • Published keys: the public verification material is served openly, alongside a feed of published banner versions.

Retention and erasure

Consent records are kept for your plan's retention period (12 months on Free, 60 months on every paid plan; custom on Scale) and then purged on schedule. Erasure requests are honoured with tombstones: the subject's data is removed while the chain's integrity remains demonstrable. Every published banner version is immutable, so you can always show exactly what a visitor saw on a given day.

Account security

Two-factor authentication (TOTP) is available to every account and can be required workspace-wide. SAML or OIDC single sign-on is coming for Scale workspaces. A signed data processing agreement is available on Scale; the sub-processor list is public.

Operations

Production credentials are never baked into images or repositories; services run with narrowly scoped database roles, secrets live in mode-600 environment files on the host, and the banner runtime makes no third-party requests of any kind: no fonts, no CDNs, no beacons to anyone but your own consent endpoint.