Trust

Security, storage and privacy controls

AnalyticFast runs on Cloudflare Workers with analytics stored in Cloudflare D1. Access is scoped to a workspace and website. Public sharing is an explicit choice.

Where is data stored?

Analytics is stored in Cloudflare D1; application requests run on Cloudflare’s network. We do not currently promise a customer-selected storage country or an EU-only residency guarantee. Ask support about your requirements before sending regulated data.

No stored IP addresses

IP addresses are not saved with analytics. Approximate location is rounded. The standard tracker uses two first-party cookies; optional cookieless mode uses a daily rotating pseudonymous identifier and must be enabled per site. Avoid names, emails and secrets in URLs and event properties.

Payment and secret protection

Provider secrets are encrypted with AES-GCM under a Worker secret. Webhook signatures are verified, and transactions are deduplicated by provider and transaction ID. AnalyticFast does not store card numbers. Payment providers may send customer identity fields used for attribution.

Tenant access

Workspace roles and scoped API tokens control access. Share links can be revoked. Public profiles disclose only explicitly enabled aggregate metrics, and private visitor journeys stay private.

Retention and deletion

Retention depends on your plan. Site deletion and account export/deletion controls are available in the dashboard. Contact support for data processing questions or a security report.

Report a vulnerability

Email security@analyticfast.com with steps to reproduce and the affected URL. Please avoid including customer data. No security certification or independent uptime guarantee is claimed.