Security

How Sectira keeps your data safe.

Sectira is built to collect less: no cookies by default, no IP addresses stored, no screen recordings. Here is what we do to protect the data we do hold, described as it actually works.

Last updated: October 20, 2026

Accounts and sign-in

Passwords are protected with industry-standard hashing. We never store or log the password itself.
Sign-in sessions are stored only in a protected form, so a copy of the database could not be used to sign in.
Your sign-in is kept out of reach of scripts on the page and is only ever sent over HTTPS. Sessions expire after 30 days, and you can sign out every other session from your account settings.
Sign-in with Google or Microsoft uses each provider's standard secure sign-in, and every sign-in is verified before it is accepted.
Sensitive changes, such as transferring a workspace or deleting an account, ask for your password again.

Team access

Every workspace has one owner. Teammates are invited with a role: admin (team and websites), editor (setup, goals and settings) or viewer (read-only reports). Only the owner can manage billing.
Every request is checked against your role in that workspace, and invitation links are stored only in a protected form.
Every analytics record is tied to a website, and reports only ever read the website you have access to.

Connected providers

When you let Sectira set things up in another account you use, the access you grant is used for that request and never stored.
Sectira only makes the changes it needs and never overwrites settings that already exist.
When Sectira checks your website during setup, it can only reach public addresses.

Payments

Payments are handled by Stripe. Card details never reach Sectira's servers. We keep only what we need to link your payments to your account.
Plan changes and cancellations go through Stripe's secure billing portal.

Visitor data

Visitors are counted anonymously and IP addresses are never stored. No cookies are set by default.
The tag never reads what visitors type into forms. Visit replay is rebuilt from page views, sections and clicks, not screen recordings.
Sectira only accepts data for a website from that website itself, and filters out automated browsers and known bots.
Ask AI sees only an aggregated summary of one website's reports, and off-topic questions are declined.

Infrastructure

Sectira runs on established cloud infrastructure. All traffic to sectira.com, the app and the tracking endpoint is encrypted with HTTPS.
Incoming data is validated and limited in size before it is stored.
Payments, email and AI providers receive only the data they need. The privacy policy lists them.

Report a vulnerability

If you think you have found a security issue, email support@sectira.comwith “Security” in the subject. Include the steps to reproduce it and what you think the impact is. We will confirm we have received it within one business day and keep you updated while we fix it.

Please give us reasonable time to fix the issue before sharing it, and do not access other customers' data or disrupt the service while testing.

Compliance

Sectira is a small company and does not currently hold third-party certifications. We would rather tell you exactly how the product works than point to a badge. For how we handle personal data, read the Privacy Policy. For anything else, contact us.

Find out which parts of your website make you money.

Paste your domain and you are set up in minutes. Then your own visitors show you which parts of your pages win customers, which lose them, and what to change first.

Start 14-day free trial See pricing

No card needed. Cancel any time.