IP handling by design
Visitor IP addresses are used transiently to derive a daily session hash and, where enabled, to perform organization-level B2B lookup. They are not stored as a field in the analytics event database.
Bot and abuse filtering
Known crawlers, uptime monitors, scripted clients and malformed requests are filtered at ingestion where detectable. Filtering protects report quality, but no automated filter can guarantee removal of every automated request.
Authentication
Dashboard sign-in uses single-use email links and signed session tokens. Client-portal passwords are salted and hashed, and portal sessions use httpOnly cookies with expiry and server-side revocation. Cookies used for signed-in product access are separate from the cookieless visitor analytics tracker.
API security
Stats API keys are shown only at creation and stored as hashes rather than plaintext. Webhook payloads are signature-verified before processing. Customers should rotate exposed keys immediately and keep keys server-side.
Infrastructure
Traffic is protected with TLS in transit, and managed database storage uses the encryption capabilities provided by the hosting platform. The production application is hosted with Railway in EU West (Amsterdam), and the production database is hosted with TiDB Cloud on AWS in Frankfurt (eu-central-1).
Responsible disclosure
If you believe you have found a vulnerability, contact security@glytiq.com with steps to reproduce it. Please do not access data that is not yours, disrupt service, or publicly disclose the issue before we have had a reasonable opportunity to investigate and remediate it.