Clickport
Start free trial
For agencies For SaaS For e-commerce For affiliates For publishers & bloggers For enterprise Google Search Console Bing Webmaster Tools WordPress Shopify Tracker install SPA tracking Custom Events API reference vs Google Analytics vs Matomo vs Cloudflare
Migrate from Google Analytics Blog Updates Documentation UTM Builder GDPR Checker GA4 Data Loss Estimator Is Google Analytics legal? About Contact Status Security How it works

Security Practices

How Clickport protects analytics records, customer accounts, and operational data.

The short version

  • The analytics tracker sets no cookies and uses rotating visitor identifiers
  • Analytics databases and backups are hosted by Hetzner in Germany
  • Encrypted in transit via TLS 1.2+, passwords hashed with bcrypt
  • Two-factor authentication, OAuth sign-in, and remote session logout on every account
  • Analytics records exclude raw IP addresses; operational logs and account security records retain them as described below
  • Hourly off-server backups and independently monitored uptime on our public status page
  • Every deployment is gated by an automated test suite with 1,400+ tests
  • Responsible disclosure program with safe harbor: security@clickport.io
  • A Data Processing Agreement is available for your compliance documentation

Data minimization

Clickport collects pageviews, events, and session data to produce analytics reports. Website analytics use rotating visitor identifiers. Account information and operational logs serve separate purposes, including sign-in, security, and service recovery.

  • No cookies set on visitor devices
  • No visitor names or email addresses required for analytics
  • No fingerprinting or cross-site tracking
  • No third-party advertising scripts or tracking pixels

IP address handling

Clickport uses visitor IP addresses for geolocation, traffic filtering, and visitor identifiers. Analytics records store the resulting location and identifiers, without the raw IP address.

Operational logs are separate from analytics records. Server logs and event recovery logs retain IP addresses. Event recovery logs also contain request bodies, user agents, and referrers so we can recover events after an outage.

Server logs rotate daily, with 30 rotated files retained. Backup copies follow separate backup retention schedules. Access is restricted to server operators.

Account sign-in sessions and security events also record IP addresses. Visitor identifiers change daily because the date is part of their calculation. The privacy policy describes these data categories.

Encryption

All data is encrypted in transit via HTTPS (TLS 1.2+). Connections without HTTPS are automatically upgraded.

Passwords are hashed with bcrypt before storage. We never store or have access to plain-text passwords.

Server location

Our analytics databases, operational logs, and backups are hosted by Hetzner Online GmbH in Germany. Our account database also runs there. Resend and Paddle separately process email and billing information, as described in the DPA.

Hetzner maintains ISO 27001 certification for its data centers. This is the hosting provider's certification. Clickport does not hold a separate ISO 27001 certification.

Infrastructure security

  • Automatic security updates enabled on the server operating system
  • Firewall configured to allow only necessary ports
  • Fail2ban active for brute-force protection on SSH and application endpoints
  • Rate limiting on all API endpoints to prevent abuse
  • Bot detection and datacenter IP blocklist to filter automated traffic
  • Every deployment is gated by an automated test suite (1,400+ tests). A failing suite aborts the release

Backups, availability and monitoring

All databases are backed up automatically every hour to separate object storage, isolated from the production server, in Hetzner's German data centers. Full-server backups run daily on top. Backups never leave the EU.

Every backup run reports to an independent heartbeat monitor, so a missed or failed backup triggers an alert. Uptime for the dashboard, API, and tracker is independently monitored as well. Current status and 90-day history are public on our status page.

Automated health checks alert us to ingestion and query errors. Standard subscriptions, including Enterprise, do not include guaranteed support response times or a service-level agreement. Any additional commitments require a separate written agreement. Contact the founder to discuss your requirements.

Access controls

Production access is limited to named, authorized operators and happens only for defined purposes: support requests, incident response, and system maintenance. Authentication is via SSH keys only. Password-based login is disabled.

No third-party analytics, tracking, or monitoring services run on the Clickport dashboard. We do not use external error tracking tools that could expose customer data.

Account security

Two-factor authentication is available on every account, using any authenticator app. Recovery codes are provided at setup and can be regenerated at any time.

You can sign in with email and password or via Google or GitHub OAuth.

Active sessions are listed in the dashboard with device and last-seen time. You can log out other devices remotely, and sessions expire automatically after 60 days.

Every account has an append-only activity log covering logins, security changes, site and billing changes, and data exports. Entries cannot be edited or removed, IP addresses are recorded for security events only, and the log is retained for 12 months before automatic deletion.

Shared dashboard links can be protected with a password (stored as a bcrypt hash, verified on every request) and scoped to a data segment that is enforced server-side on every query. Password attempts are rate-limited, and revoking a link takes effect immediately.

Team access uses role-based permissions (owner, admin, editor, viewer, plus site-scoped guests) enforced server-side on every request, so removing someone takes effect on their next click. Guest access can be restricted to a data segment, enforced in the query layer. Every people change, role change, and removal is recorded in the team activity trail.

Accessibility

The Clickport dashboard is designed to meet WCAG 2.1 AA. You can operate it with a keyboard alone, form fields and controls carry proper labels for assistive technology, text and interface colors meet AA contrast ratios in both light and dark themes, and animations respect your system's reduced-motion preference.

An automated accessibility audit runs in our test suite on every release, so a regression blocks the deploy before it ships.

Data ownership and deletion

Your data belongs to you. We do not sell, share, or monetize it in any way.

You can export all your analytics data as CSV at any time. You can delete individual sites or your entire account from the dashboard settings. Deletion is immediate and permanent.

Sub-processors

We use a minimal number of third-party services:

  • Hetzner (Germany): Server hosting and infrastructure
  • Resend (USA): Transactional email delivery only. Certified under the EU-US Data Privacy Framework
  • Paddle (UK): Payment processing as merchant of record. PCI DSS compliant. Card details never touch our servers

Hetzner provides the infrastructure that stores visitor analytics data. We do not send visitor analytics data to Resend or Paddle. Resend processes customer email information, and Paddle processes payment and billing information.

Vulnerability disclosure

If you discover a security vulnerability in Clickport, we encourage responsible disclosure. Please report it to security@clickport.io.

Guidelines

  • Provide sufficient detail to reproduce the vulnerability
  • Allow reasonable time for us to address the issue before public disclosure
  • Do not access, modify, or delete data belonging to other users

Scope

The following are in scope: services on clickport.io, the tracker script, and the API.

Out of scope: automated scanner reports, social engineering, denial of service attacks, third-party service vulnerabilities, and issues requiring physical access.

No paid bug bounty

We do not operate a paid bug bounty program and do not offer monetary rewards for vulnerability reports. Unsolicited reports requesting payment are handled at our discretion. Researchers who report valid issues responsibly are credited with our thanks.

Safe harbor

Security research conducted in good faith and in accordance with these guidelines is considered authorized. We will not pursue legal action against researchers who follow this policy.

Legal documents

For more details on how we handle data:

Questions

For security questions or concerns, contact us at security@clickport.io.

Last updated: September 22, 2026.