What a security review will find.
The inventory your security team will ask for, written out before they ask.
What is already true
- Tenant isolation enforced by Postgres row-level security, not by application filters, with a dedicated isolation suite gating CI.
- Passwords hashed with scrypt at OWASP’s floor; a 12-character minimum.
- Short-lived access tokens plus a rotating refresh token in an httpOnly cookie, stored as a digest so sessions can be revoked.
- Removing someone from a workspace takes effect on their next request — membership is joined, not trusted from a stale claim.
- No device identifiers, IP addresses or user agents in the analytics store by default. Custom event properties and captured search terms are fields you control, and personal data you put in them is stored like any other value.
The shortest part of the review
A tool that collects no visitor personal data by default is a materially shorter assessment than one that collects it and then protects it. Much of the questionnaire asks what happens to it; for the defaults the answer is that there is none to describe.
Three things are worth listing separately rather than waving through on that answer: account records, which do hold names and email addresses; anything you choose to put in a custom event property; and captured site-search terms, which are filtered at ingest but are still text your visitors typed.
Worth knowing before you start
Written into the terms: 99% monthly availability, and deletion within 30 days of a written request. The sub-processor register is published and names every third party that can access data. The Enterprise tier is quoted rather than sold, so the commercial terms are agreed with you directly.