1. The tracker on your site
Your pages run one file from Highseat: the tracker. Anyone who could change that file could run code on every site that loads it. These rules keep it unchanged:
- Every site loads the same file. The snippet on the page names the site, so no customer gets a version of their own.
- The tracker never runs code it downloads. It sends events and reads back only the status of each response, so our server cannot send it instructions.
- Each deploy builds the file from our source code and ships it inside the app. The app runs on a read-only file system, so nothing on the server can change the file. A new version ships only with a new deploy.
- Every ten minutes, a check running outside our server downloads both copies of the file from cdn.highseat.com: the one in Cloudflare's cache and the one our server sends. It compares each, byte for byte, with a fresh build of our source code and alerts us on any difference.
- A site that loads the tracker through a first-party proxy on its own domain gets the same file, which the proxy fetches from cdn.highseat.com.
The privacy policy lists what the tracker collects and what it never stores.
2. How code reaches production
Code reaches production one way. Every change lands on our main branch and must pass the test suite there. GitHub Actions then builds the app, and the server pulls that build from GitHub's container registry. Nobody edits code on the server.
3. Where the data lives
- Events and account data sit on one dedicated server at Hetzner in Helsinki, Finland. The databases are reachable only from the app's internal network, never from the internet.
- Both databases are backed up off site every day, to Cloudflare R2 in Western Europe. Backups of events are kept for up to 60 days, backups of account data for up to 14 days.
- Cloudflare encrypts every object in R2 at rest, including the backups.
The sub-processors page lists every outside service that handles personal data for us.
4. Access
- Every connection to the app and to ingest uses HTTPS.
- Members have one of three roles: owner, admin or viewer. Only owners and admins can export, erase or delete. A share link shows only the reports it was made for.
- Passwords are stored as hashes. API keys and site secrets are stored only as SHA-256 hashes, so a database copy cannot be used to sign in or report.
- Secrets for connected payment providers are encrypted with AES-256-GCM under keys kept outside the database, and the keys can be rotated.
- Sign-in, share links and ingest are rate limited. Each sign-in session can be seen and ended by its owner.
- Only the people named for it can reach the production server and its deploy panel.
- The server accepts sign-in by SSH key only, with passwords switched off. The deploy panel reaches the server over a private, encrypted network.
- The deploy panel is not open to the internet. Reaching it takes a separate sign-in through Cloudflare Access before the panel's own login.
5. Monitoring
- Errors and request traces go to Better Stack with secret tokens removed from every URL first.
- Alerts fire when ingest fails or starts losing events.
- Event inserts are deduplicated, so a retried request is stored once.
- Deletes are applied twice for a deleted site, and deleted rows are removed from disk by an hourly job.
6. Reporting a problem
If you find a security problem, email support@highseat.com with the details. Please give us time to fix it before you publish it.
If a breach affects your data, we email your workspace owners within 48 hours, as the data processing agreement sets out.