Security at ProductLense

Data location

Customer data is stored on servers in Germany. A content delivery network in front provides TLS, DDoS protection and caching of the tracking script. Encrypted nightly backups are kept for 30 days. Production systems accept only web traffic from the content delivery network, and administrative access is limited to named people.

Encryption

• All traffic uses TLS.
• Billing provider credentials are encrypted at rest with a key held only in the server’s environment, never in code or the database.
• API keys (mk_live_…) are stored as SHA-256 hashes and shown once.
• Backups are encrypted.

Accounts and sessions

• Sign-in is by magic link: tokens expire after 15 minutes and work once.
• Sessions are HttpOnly, SameSite=Lax cookies on the dashboard origin, valid for 30 days. This site never handles sign-in.
• Authentication routes are rate limited per IP.

Data minimisation

• No cookies or device storage on visitors, and no stored IP addresses; see privacy.
• Raw events are deleted after 90 days.
• Every row and query is scoped by site id.
• The AI features receive only aggregates and the question; model output is validated and never executed.

Integrations

• Billing connections are read-only and use the providers’ own least-privilege keys where they exist, such as Stripe restricted keys.
• Every webhook is verified with the provider’s signature, and replays are rejected by event id.

Reporting a vulnerability

Email security@productlense.app with steps to reproduce. Please do not open a public issue, access other customers’ data, or degrade the service while testing. We acknowledge reports, keep you informed while we fix them, and credit you if you wish. A machine-readable contact is at /.well-known/security.txt.

We do not hold ISO 27001 or SOC 2 certifications. The DPA lists our technical and organisational measures. The list of subprocessors is available on request at privacy@productlense.app.