How we keep your data safe

Metric Sensei holds the keys to your ad accounts, your store and your CRM. Here is how we look after them, in plain words. The Privacy Policy has the full detail of what we collect and how long we keep it.

Your data stays yours

• Each client is kept separate. Every request is checked against the signed-in person’s own account, and one client’s data is never mixed with another’s.
• Delete means delete. When a client account is deleted, its data is removed from every Metric Sensei service, including tracking data, reports, recordings and connected-account credentials.
• Visitor privacy requests. When one of a client’s visitors asks to see or delete their data, the client can find it across every Metric Sensei service, export it or delete it, after checking who is asking. Requests sent to us are passed to the client.
• We don’t sell data and we don’t use one client’s data to advertise to anyone.

Personal data is minimised at the source

• Contact details that visitors type into forms are normalised and turned into one-way SHA-256 hashes in the visitor’s browser, before anything is sent. The tag never reads passwords, payment fields or hidden fields.
• If a client turns on contact lookup, the one readable copy is encrypted in the browser with a key that only our admin service can use.
• Analytics stores no IP addresses, full user agents, query strings or form values.
• Session replay masks everything typed into fields and, by default, all page text.
• Customer lists sent to Google Ads audiences are normalised and hashed before they leave Metric Sensei, and are never stored.
• Automated browsers and visits from cloud hosting networks are kept out of tracking, so bots don’t pollute reports or conversions.

Credentials and secrets

• Sign-in details for your connected accounts are encrypted with keys held in AWS Key Management Service, and each encrypted value is bound to its own account so it can’t be read anywhere else.
• Personal API tokens and sign-in tokens are stored only as hashes. A token is shown once, when it is created, and the same token works with both public APIs, acting with its owner’s current role.
• Connected accounts are read-only unless an admin allows changes. Risky changes, such as raising an ad budget or publishing, show a preview and wait for confirmation.

Sign-in and access

• Passkeys and two-step verification with an authenticator app, or your company’s own sign-in (OIDC or SAML), Google or Microsoft.
• A role for each person (admin, manager or user), and users can be limited to chosen connections.
• Creating or changing an API key needs a fresh sign-in.
• Every change an admin makes is recorded in the account’s activity log, with who did it and when. Changes made through the API/MCP Gateway are logged too, without the values.
• Our staff can open a client’s account only while helping that client, for up to one hour at a time, with a stated reason that is recorded in the client’s activity log.

The AI assistant

• The assistant has no access of its own. It acts with the signed-in person’s own permissions, and loses them the moment the person does.
• Anything that would change data waits for the person to approve it.
• It runs on Anthropic’s Claude through Amazon Bedrock, inside our AWS account. Amazon Bedrock does not use prompts or answers to train its models.

Network monitoring

• Collectors only make outgoing HTTPS connections to us, so no firewall ports are opened.
• Device passwords and SNMP communities are encrypted in each account’s sealed store and are never readable in our database.

Built to stay up

• Metric Sensei runs on Amazon Web Services in two separate US regions, US East and US West. Both serve traffic, and if one fails the other carries on.
• Data is encrypted in transit (HTTPS) and at rest.
• Public APIs are versioned. A version you rely on keeps working until it is retired with notice.

Report a security problem

If you think you have found a security weakness, please email [email protected] rather than testing it further. We welcome reports made in good faith and will reply.