Visitor tracking software security at VisitorDetector
A tracking snippet runs on your website and the data it sends describes your traffic, so security matters before anything else. This page describes the measures that are part of how VisitorDetector is built. We keep it modest and specific: what we do by design, and how you can reach us about security.
Less data is the first security measure
The safest data is the data we never collect. VisitorDetector works at the company level only, so the product holds no visitor names, no visitor email addresses and no personal profiles. Residential, mobile carrier and known VPN traffic is not matched and stays anonymous.
Read the full picture in privacy-first visitor identification.
- Only the data needed to match a business network and show visit history is processed.
- IP truncation shortens the stored address after matching when you turn it on.
- No form field capture and no keystroke recording on your pages.
Encryption in transit and at rest
- The snippet, the dashboard and the integrations communicate over TLS.
- Stored data is encrypted at rest on managed cloud infrastructure.
- Integration tokens for HubSpot, Pipedrive, Salesforce and Slack are stored encrypted and used only for the sync you set up.
Access control by roles
Every account has roles, so people see and change only what their job needs. Admins manage billing, seats, integrations and privacy settings. Members work with lists, alerts and exports.
- Access for our own staff is limited to what is needed to run and support the service.
- Seats are listed in the account, and admins remove access in one step.
- On Enterprise, SSO (SAML) lets you sign in through your identity provider, and SCIM provisions and removes users automatically.
Retention and deletion
Visit data is kept for 13 months by default, and you can shorten the retention setting. Starter keeps 90 days of history, and Enterprise can agree custom retention.
- When data passes the retention period, it is deleted.
- We delete a company record, a visit history or a whole account on request.
- When you close your account, your data is deleted after the end of the paid period.
A small, isolated snippet
The tracking snippet is one async script under 10 KB that loads after your page. It does not read form fields, does not change your page content, and does not require third-party cookies. You can load it through your tag manager and control it with your existing consent mode setup. See how it works for the full flow.
Security review and agreements on Enterprise
Enterprise plans include a security review: send your questionnaire by email and we answer it in writing. Enterprise also includes a DPA, a named support contact, SSO (SAML), SCIM and invoicing on net 30 terms. Everything is set up self-service, without sales calls. Compare plans on visitor identification pricing.
Report a security issue
If you believe you have found a security issue in VisitorDetector, email [email protected] with a description and steps to reproduce. Please give us reasonable time to investigate and fix the issue before you share it publicly, and do not access or change data that is not yours while testing. We reply to every report.
Start with security in place
Try the detection plan on your site with try the demo, then create an account and set roles, retention and IP truncation before you install the snippet.