Security

The single most useful property of this product’s security is architectural rather than procedural: we ask for credentials that cannot write.

• Stripe is connected with a restricted key you create, scoped to read. Even a total compromise of our servers could not issue a refund, move a payout or alter a customer record in your Stripe account.
• Google Analytics is connected through Google’s own consent screen using the read-only Analytics scope. We can read reports; we cannot change your property, your goals, or anything else in your Google account.
• We never write back to a connected system. There is no code path that does.

Connector credentials are encrypted with AES-256-GCM before they touch the database, under a key held in the application environment and not in the database itself. Someone who obtained a copy of the database alone would hold ciphertext.

Passwords are hashed with bcrypt at cost 12 and are never stored, logged or recoverable — including by us. Reset links, invitations and email confirmations are high-entropy, single-use, time-limited, and stored only as SHA-256 digests, so a database copy contains no working links.

• Two-step verification using any authenticator app, with recovery codes, available on every account from Settings. It applies to password and single sign-on logins alike.
• Sign-in, signup and password reset are rate-limited by both email address and IP, and answer identically whether or not an account exists — so the login form can’t be used to discover who our customers are.
• Sessions are signed, HTTP-only, same-site cookies. Signing out invalidates them, and changing a password sends you an email saying so.
• Roles — owner, admin, analyst, viewer — are enforced on the server for every action, not just hidden in the interface.

Almost nothing, and that is deliberate. Data from Stripe and Google Analytics is reduced to daily totals as it is read. We do not store your customers’ names, email addresses, card details or individual transactions, and we hold no Analytics identifiers.

The practical consequence: a breach of our systems could not expose your customer list, because it isn’t there. The privacy policy lists field by field what is kept.

• All traffic is served over TLS, with HTTP redirected to HTTPS.
• The database is not exposed to the internet. It accepts connections only from the application host.
• The application and the background worker run as separate processes, so a stuck sync cannot take the app down with it.
• Payments are handled entirely by Stripe. Card numbers never reach our servers.

We are not SOC 2 certified and we are not ISO 27001 certified. Neither is a small undertaking and we would rather say so than imply otherwise — if you see a badge claiming either on any page of this site, it is an error and we would like to know.

We do operate in line with UK GDPR: a named controller, a documented lawful basis, a published list of subprocessors, honoured deletion requests, and breach notification within 72 hours. A data processing agreement is available on request from privacy@analyzebusinessdata.com.

Email security@analyzebusinessdata.com with enough detail to reproduce it. We will acknowledge within two working days and keep you updated until it is fixed.

We will not pursue you for good-faith research: testing only against your own account, without degrading the service for anyone else, without accessing data that isn’t yours, and giving us a reasonable chance to fix it before publishing. We don’t currently pay bounties, and we will credit you if you would like.