Security & Trust Center
Full transparency on security and compliance · Last updated October 4, 2026
Certification status
Last updated October 4, 2026
GDPR
Rights of access, rectification, erasure and portability built into the product, EU hosting, sub-processors and retention periods published.
EU hosting · DPA available on request · Art. 15-22 implemented · privacy@metrikia.io
CASA Tier 2
Cloud Application Security Assessment required by Google for restricted OAuth scope auth/adwords access.
OWASP ASVS 4.0 · 50+ controls verified · Feb 2026
Infrastructure DPA
Data Processing Agreement with Railway (EU host), compliant with GDPR Article 28.
DocuSign · EU SCCs · Signed 2026-02-24
SOC 2 Type II
Trust Service Criteria certification (Security, Availability, Confidentiality) per AICPA.
~87% of controls in place · Roadmap Q4 2026
Security architecture
Technical controls in place on every layer of the application.
Encryption
Connection credentials, lead contact details (name, email, phone), lead messages and user account details encrypted at rest by the application (authenticated encryption, 256-bit key). HTTPS only, TLS 1.2 or higher, TLS 1.3 whenever the client supports it, HSTS.
Strong authentication
MFA available to every user, mandatory for Metrikia administrators and support staff. Short-lived sessions, refresh cookies HttpOnly and SameSite=Strict, revoked on logout. Login attempts are rate limited.
Multi-tenant isolation
Strict per-account isolation, enforced at the data access layer and continuously tested. Zero cross-account leakage.
Integration disconnect
Disconnecting an integration deletes its credentials from Metrikia; deactivating it stops processing but keeps them. To remove access at Google or Meta, use your account's security settings (TikTok and Pinterest: Metrikia also asks the provider to revoke the token on disconnect).
Security Headers
HSTS, strict CSP, X-Frame-Options, CORS, X-Content-Type-Options on all API and frontend endpoints.
CI/CD Security
Every proposed change is checked automatically for known vulnerabilities in dependencies and by static code analysis. The full test suite and a vulnerability scan of the container image run on demand in the same pipeline.
Backups and resilience
Primary database run as a high-availability cluster with automatic failover in our EU hosting region. Database backups at our EU hosting provider; recovery objectives are documented internally.
Monitoring & Alerts
Error and scheduled-job monitoring (Sentry), continuous alerting.
Sub-processors
Third parties that process the data you manage in Metrikia on our behalf, as listed in Annex III of our DPA.
| Sub-processor | Purpose | Region | Safeguards |
|---|---|---|---|
| Railway | Cloud hosting: application, databases and background processing | EU West, Amsterdam (NL) | DPA signed · EU SCCs |
| Buldee | Application development and maintenance | EU, France | EEA · Sub-processing agreement and confidentiality |
| Sentry (Functional Software, Inc.) | Error monitoring and performance tracing | EU, Frankfurt (DE); account metadata in the US | |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | United States | |
| Anthropic | AI assistant Diana, lead score explanations, import mapping and ad creative analysis | United States | EU SCCs · No training on your data |
| OpenAI | Text embeddings for the help assistant search | United States |
Ad platforms (Meta, Google, TikTok, Pinterest, Snapchat) receive conversion events only when you enable the Conversions API on a data source. They receive them as recipients on your instruction, not as our sub-processors.
Any changes to the sub-processor list are notified to customers with 30 days advance notice.
Responsible disclosure
If you identify a security vulnerability in Metrikia, we invite you to report it responsibly. We commit to responding within 48 business hours and fixing critical vulnerabilities within 7 days.