Skip to content
Plaintrace
Start free

Company

Security

Plaintrace is a product of VALUNLABS LLC. We hold analytics for other people’s websites, so we try to hold as little as possible, and to protect the rest by design rather than by promise. Each point below is enforced in code and covered by automated tests.

Data minimisation

  • No raw IP addresses in storage. The collector uses the address for the daily visitor hash, location and bot checks, then drops it. An end-to-end test inspects every message on the queue to make sure.
  • Daily salts. Visitor hashes use a secret salt that changes every day in the site’s own time zone. Salts are encrypted at rest and deleted after use, so yesterday’s hashes cannot be recomputed.
  • Sanitised addresses. Fragments, credentials, sensitive query parameters, emails and long digit runs are removed in the browser and again on the collector.

Durable ingestion

  • An accepted event is stored. The collector answers 202 only after the event is written to a durable queue. If the database is down, events wait in the queue and nothing is lost.

Keys and secrets

  • API keys (sk_live_…) are shown once; we store only a SHA-256 hash. Each key is bound to one site and carries explicit scopes (read, write, manage, ingest).
  • Signing secrets, Stripe keys and webhook secrets are sealed with AES-256-GCM under a master key, bound to the site or key they belong to.
  • Server SDK calls are signed with HMAC over the method, path, body and time.
  • Stripe accepts only restricted, read-only keys.

Accounts and the dashboard

  • Sign-in by email link, GitHub or Google; no passwords to leak.
  • Changes made with a session must come from the dashboard’s own origin.
  • A strict Content Security Policy, no framing, and no third-party scripts in the dashboard.
  • The AI assistant (MCP) accepts only read keys, never a session, and answers with totals only.

Hosting

  • Data is processed and stored in the EU.

Reporting a vulnerability

Write to hello@plaintrace.dev with “Security” in the subject. We acknowledge reports within two working days and will not take action against good-faith research that respects our users’ data.