Security overview.

This page is the security companion to the Sealmetrics Trust Center. It summarizes the actual technical and organizational measures protecting the service, consistent with Annex 2 (Art. 32 GDPR) of the Data Processing Agreement; in case of discrepancy, the DPA prevails.

1. Privacy-by-design architecture

• No cookies, no device storage. The measurement pixel uses no cookies, localStorage, sessionStorage, IndexedDB or any other storage on the visitor’s device — verified against the code served in production, not merely declared.
• No persisted IP addresses. The visitor’s IP has no column in any analytics database: the column was explicitly removed through a dedicated schema migration as a minimization-by-design decision. IP use is transient, in memory, during event processing.
• Country from timezone, not from IP. The geographic dimension in reports is derived from the browser timezone via a static lookup table — the component resolving it does not even receive the IP as a parameter.
• Ephemeral identifiers. The session identifier is computed in the browser from technical characteristics, writing nothing to the device. Maximum effective lifetime: 2 hours in the active session, 14 days in the technical log. Reporting tables are 100% aggregated and do not contain it.
• No direct visitor identifiers. No names, no emails, no cross-site identifiers; per-account isolation in keys and tables. Campaign parameters (UTMs, click IDs) are processed server-side within the EU, never extracted on the device.

2. Encryption

3. Isolation and access control

Every table and key carries the account identifier, and queries are validated against the requester’s account: each customer’s data is collected, processed and stored independently (multi-publisher independence, DPA clause 3.3). Platform access uses role-based access control (organization and site roles), MFA — available to users (TOTP) and required for Sealmetrics personnel — the least-privilege principle with confidentiality undertakings that survive the working relationship, and logged administrative access. Customers can additionally restrict API access with a per-account IP allowlist and exclude their own IPs from measurement.

4. Automatic retention

Retention periods for analytics data are fixed, non-configurable and applied via automatic database-level TTL — compliance does not depend on manual processes. They meet the indicative 25-month maximum of the AEPD audience-measurement guidance (January 2024).

5. EU infrastructure

The visitor data flow is entirely within the EU and does not rely on the EU-US Data Privacy Framework or SCCs. Sole transfer outside the EEA: service emails (verifications, alerts, reports with aggregated metrics) to the account’s users via Resend, Inc. (USA), covered by SCCs and its EU-US DPF certification — affecting no visitor data. Full sub-processor list: sealmetrics.com/dpa.

6. Secrets management and supply chain

Platform keys live exclusively in secret managers — never in code or repositories. Content logging is prohibited across the AI chain: Seal AI prompts and responses are not written to logs, and Sealmetrics persists only token counters for billing and capacity. Third-party dependency install scripts are blocked by default with an explicit allowlist, reducing the supply-chain attack surface. The pixel is protected against data injection with HMAC-signed expiring tokens, domain validation and inter-service message signing.

7. Incident and breach management

Sealmetrics maintains a documented breach-management procedure (classification, containment, analysis, communication). Customers are notified without undue delay once Sealmetrics becomes aware of a breach affecting Service Data — mindful of the customer’s 72-hour window towards the supervisory authority (DPA clause 4.5) — with the Art. 33(3) GDPR particulars as available, in phases where necessary. An internal breach register is kept per Art. 33(5) GDPR, retained 5 years from closure.

8. Compliance

• GDPR: Sealmetrics processes analytics data under an Art. 28-compliant DPA with commitments of no data reuse, purpose restriction and multi-publisher independence.
• AEPD criteria: designed in accordance with the AEPD guidance on cookies for audience-measurement tools (January 2024), including the contractual guarantees of its section III.C.
• Current DPIA, reviewed after significant architecture changes, plus periodic internal audits verifying actual code behavior against public documentation.
• Configuration assessment on request: customers may request the documented assessment of the service configuration against the AEPD guidance (DPA clause 3.5), updated at least annually. Customer audit rights per DPA clause 4.7.

Sealmetrics does not currently hold formal third-party certifications (e.g. ISO 27001 or SOC 2); the assurances on this page rest on the contractual measures of the DPA and the internal technical verification described above.

Related: Privacy Policy · DPA · Terms of Service. Security or privacy inquiries: privacy@sealmetrics.com.