GA Connector processes data about your website visitors and connects to your CRM. This page describes how we protect that data.
In short
- The data our service stores stays in the EU. We store and process it in Frankfurt, Germany.
- We collect as little as we can. Personal details of your website visitors are hashed in their browser before they reach us, and visitor data is deleted automatically after 90 days.
- Your connection is always encrypted, and your data is encrypted when stored.
- Access is strictly limited. Only a few people can reach our systems, and that access is protected by industry-standard safeguards.
- Independently tested. In October 2026, an independent, ISO 27001-certified security firm tested the live service.
- We back up every day, and we test our backups. In our last recovery test, the database was back online in 18 minutes.
Hosted in the EU
GA Connector runs on Amazon Web Services in Frankfurt, Germany, and the data the service stores is kept there.
Error logging stays in Frankfurt too, and error logs are deleted after 90 days.
The database and the services that handle tracking and CRM sync each run in more than one data center, so the failure of one doesn't stop tracking.
We collect as little as possible
We use your data only to provide the service you set up. We never use it for advertising, to profile people across customers, or to train AI models.
Our tracking is built to store as little as possible, and we never save your visitors' IP addresses. You can choose between two setups:
- Zero-storage mode. Attribution data stays in the visitor's browser and goes straight into your CRM with the form submission. We store no information about your visitors on our servers.
- Simplified setup (Smart Tracking). To make installation easier, we keep a small amount of data on our servers to match a visitor to a new CRM record. Personal details are hashed in the visitor's browser before they reach us, and everything is deleted automatically after 90 days. You can ask us to delete a specific visitor sooner.
When we send CRM updates to your analytics, we keep only the fields we need to detect changes, never a full copy of your CRM.
Your account password is stored only as a one-way hash, so nobody can read it, including us.
For what we store, how long we keep it, and how GDPR applies, see The GDPR and GA Connector. We provide a data processing agreement when you sign up.
Encryption
- All connections to GA Connector use HTTPS (TLS 1.2 or later).
- Connections between our own services and our database are encrypted as well.
- Our database, every backup, and our error reports are encrypted at rest.
- Your CRM connection credentials are encrypted before we store them. Our own passwords and keys are kept in a dedicated, encrypted secrets manager.
Strict access control
Access to our cloud hosting account is strictly limited to the few team members who need it for their work, and it is protected by multi-factor authentication.
Our databases are on a private network and can't be reached from the internet. Our engineers reach them only through an encrypted VPN, and our servers don't accept remote logins from the internet.
All application traffic to GA Connector passes through Cloudflare, which protects the service against DDoS attacks. Our servers accept web traffic only from Cloudflare.
How we build and release the service
Every change to our systems goes through a controlled release process. Our QA team tests every change manually. Changes to our backend services must also pass automated checks before release, and if a check fails, the release stops. The exact version that passes these checks is the one that runs in production.
We protect the service against supply-chain attacks, where malicious code gets in through third-party software. In our backend services, we use fixed, known versions of every third-party package and block the install scripts that such attacks often rely on. We monitor everything that runs in production for known vulnerabilities.
Independent penetration testing
In October 2026, an independent, ISO 27001-certified cybersecurity firm tested the live service. The firm works with regulated industries such as finance, healthcare and energy, and its team holds industry certifications including OSCP, CISSP and CEH. We plan to repeat the test in 2027.
Continuous monitoring
Our hosting account is monitored continuously for threats. Every administrative action is recorded in a tamper-evident audit log that we keep for a year.
Our team is alerted automatically to security findings and to any problems with server health, availability, or database load.
Daily backups and restore testing
Our databases are backed up automatically every day. Backups are encrypted, stored in the EU, and kept for 30 days. The databases are also protected against accidental deletion.
A backup is only useful if you can restore it. We tested a full restore in October 2026 and repeat it at least once a year.
If something goes wrong
We have a written information security policy and incident response plan, and we review them at least once a year. You can request a copy at [email protected].
If a data breach ever affects data we process for you, we will tell you without undue delay. We don't wait until our investigation is finished to let you know, and if your contract sets a shorter deadline, we meet it.
Report a security issue
If you think you have found a security problem, we want to hear about it. Email [email protected] and we will look into it.
Last updated: October 2026
