Skip to main content
TrackRev is built first-party by design: your tracking data stays on your domain, and TrackRev never gets write access to your payment provider. This page summarises the posture; the canonical statements live at trackrev.io/security and trackrev.io/privacy.

​
Your data stays on your domain

Tracking is first-party and server-side. A click hits TrackRev’s server, the click is logged, and the visitor cookie is set on your domain — there’s no third-party tracking script in the browser, no cross-site profiling, and no ad-network data sharing. You own the tracking domain and its DNS.

​
Read-only payment access

TrackRev connects to your payment processor with a restricted, read-only key — it can read charges, checkout sessions, customers and payment intents, and nothing else. It cannot create charges, issue refunds, move money or change settings, and it never stores the full secret key in plain text (keys are encrypted). Revoke access any time from your processor’s dashboard.

​
GDPR & privacy

  • The first-party architecture is GDPR-compatible by default. You are the data controller; TrackRev is the processor. A DPA is available on request at maruf@trackrev.io.
  • The visitor cookie lifetime is tied to your attribution window. There’s no sale of data and no ad profiles.
  • No third-party analytics or ad trackers run on the marketing site or dashboard — TrackRev dogfoods its own first-party analytics.

​
Infrastructure

TrackRev runs on Vercel (edge redirects) and Supabase (PostgreSQL, in the US region), with workspace isolation enforced at the database layer and daily backups. Redirects are served from the edge and tracking is written asynchronously, so a database hiccup never blocks a redirect.
Sub-processors include Stripe (PCI DSS Level 1), Vercel and Supabase. A formal SOC 2 report isn’t available yet (it’s on the roadmap); the underlying infrastructure providers are SOC 2 Type II.

​
Data requests

For data-deletion requests, DPAs, or security disclosures, contact maruf@trackrev.io. Good-faith vulnerability research is welcomed under a safe-harbour policy.