How Trackian protects your data | Trackian Help Center

Trackian connects to your analytics, advertising and store platforms so it can report on them and flag problems early. To do that you trust us with two things: access to those platforms, and the data that comes out of them. This page explains how we look after both, and which controls are in your hands.

Our approach in brief

We take the least access that does the job. Where a platform offers read-only access, that is what we ask for.
Your company's data is walled off from every other company's. That separation is checked on each request and guarded by automated tests.
Nothing changes in your accounts without you. The ability to make changes is off until you turn it on, and each change is previewed and confirmed first.
You stay in control. You decide who on your team sees what, which keys exist, and which connections stay live, and you can withdraw any of them.

Who can get into your account

Access to Trackian starts with sign-in, which is handled by a dedicated identity service that is separate from the rest of the application. Once you are signed in, each request you make is verified again before any data is returned, so a page left open does not stay trusted forever: sessions expire automatically.

We never store passwords in a readable form.

Inside your company, you decide who sees what:

Every team member has a role, from owner down to guest, and the role decides what they can do.
Members who are not owners or administrators can be limited to specific projects, with view-only or edit rights on each.
Only owners and administrators can change what other members are allowed to see.
Billing pages are limited to the roles that need them.
An invitation can only be accepted by the person it was sent to.
When you remove or deactivate someone, their access ends immediately, not at their next sign-in.

Keeping your data separate from everyone else's

Trackian serves many companies from one platform, so the most important promise we make is that one company never sees another's data. We build that separation in at several levels, so that it does not depend on any single check.

At the door. Every request is tied to an active membership of one company, and data is returned only for that company. If you belong to more than one company, for example as an agency, you work in one at a time, and switching requires an active membership in the company you switch to.

In storage. The data we collect from your platforms is kept in a space of its own for each project, not mixed into tables shared with other customers. A report, an export or an AI assistant working for you draws only on what is yours.

Through connected accounts and keys. A connected platform account belongs to the company that connected it, and only that company can use or remove it. An API key can only ever be pointed at projects of the company that created it.

Through AI assistants. An assistant's company is fixed by its key. It cannot name a different company and be believed. If it asks for something outside your company, the answer is the same refusal whether or not that thing exists, so nothing about other customers can be learned by probing, and the attempt is recorded.

Inside your company. Separation also works within your own team: members can be limited to the projects they need, as described above.

How we keep it that way. Checking every identifier in a request against the caller's company is a written engineering rule, not a convention. It is part of every code review, and a missing check blocks the change. Automated tests fail if a request for another company's data is ever answered.

The access you give us to your platforms

When you connect a platform, you are lending us a permission. We treat it that way.

Read-only first. For analytics, search and store connections we ask for read-only access wherever the platform offers it. For tag management we never ask for permission to publish or to manage users.
Honest about the exceptions. Some advertising platforms offer only a single permission that also allows changes. Holding that permission does not mean we use it: Trackian changes something in those accounts only when you have switched that ability on and then confirmed the specific change.
Stored safely. The credentials you grant us are encrypted before they are stored. They are used by our data pipeline on your behalf and are never sent back to your browser.
Tracked. Each time our data pipeline uses a stored credential to collect your data, that use is recorded.
Withdrawn when you say so. Disconnecting an account removes the stored credentials for it and the data sources that relied on them. If a platform tells us access has been withdrawn, we stop using that connection until you reconnect it.

API keys and AI assistants

Trackian can be used from your own tools and from AI assistants. Those connections run on keys that you create, and they are built so that a key is never more powerful than you meant it to be.

A key is shown to you once, when you create it. After that, nobody can retrieve it, including us.
You choose what each key may do, area by area, and whether it may only read or also make changes.
You can limit a key to a single project, give it an expiry date, and revoke it. Keys also stop working if your subscription ends.
An assistant can only reach the company its key belongs to. Attempts to reach anything else are refused and recorded.
Free-form questions an assistant asks of your data are read-only and limited to your own reporting data. Records about individual shoppers are out of reach.
When something goes wrong, the assistant is told what it needs to know and nothing about our internal systems.
Activity through your keys is logged.

Changes are always deliberate. Making changes in your ad accounts or store through an assistant is off by default. When you turn it on, every change is shown to you as a preview first and is applied only after it is confirmed. A confirmation covers that one change and nothing else. New campaigns start paused, so nothing begins spending until you say so.

AI and your data

Trackian uses AI models from third-party providers to investigate anomalies and to write up what it finds. When it does, the relevant figures from your account are sent to a model to be analysed.

Not used for training. We only use model endpoints that do not train on the data we send them.
Not kept by the model provider. We only use model endpoints that do not store your data once the answer has been returned. A request that could only be served by an endpoint that keeps data is refused, not rerouted.
Your own assistants are yours. If you connect your own AI assistant to Trackian with a key, what that assistant does with the answers is governed by your agreement with its provider, not by ours.

Your shoppers' data

If you connect a store, some of what flows through Trackian is about your customers, not just about you. We keep that to what reporting needs.

The tools we offer to AI assistants work with order and product figures, not with your buyers' names or contact details.
For Shopify stores, shopper details are collected only if you have granted that access in Shopify.
For Shopify stores, we honour erasure requests. When a shopper asks to be forgotten, their records are removed or anonymised. When a shop asks, its data and its connection are removed.
Our tracking pixel does not store visitors' IP addresses.

Payments

Card payments are handled by Stripe on Stripe's own checkout page. Trackian does not store card numbers. We check that notifications from payment and store providers are genuine before acting on them.

Who at Trackian can see your data

You should not have to guess who on our side can reach your account. These are all the ways it can happen, and what each one is for.

With your permission: support access. This is the normal route. When you want our help inside your account, an owner or administrator of your company grants our support team access from your settings. You can see that the access is there, and you can revoke it whenever you choose. While it is active, our support team sees your company the way one of your own administrators would.

Automated processing. Most of the time, the only thing touching your data is the software itself: collecting from your connected platforms, building your reports and checking for anomalies.

Infrastructure

Trackian runs on two providers. The application you sign in to and its main database run on Google Cloud. The systems that collect and process data from your connected platforms run on dedicated infrastructure at Hetzner.

Connections to Trackian are encrypted in transit.
The engine that schedules and runs data collection has no public address. It cannot be reached from the internet, only from inside our own private network, and our engineers reach it through an authenticated administrative channel.
The internal storage behind our sign-in service is likewise private and has no public address.

How we build

Every change goes through a pull request and a security-focused review before release. The review includes a pass whose only job is to try to break the change.
Our engineering rules require that each request is checked against the caller's company and that incoming data is validated before it is used.
Automated tests guard the separation between companies, the limits on what keys and assistants can do, and the access rules described on this page.
When a review misses something, we record the miss and add it to what future reviews check.

What you can do

Give each team member the lowest role that lets them do their work, and limit them to the projects they need.
Create a separate key for each tool or assistant, scope it to one project where you can, and set an expiry date.
Leave change permissions off on keys that only need to read.
Remove people, keys and connections you no longer use.

Questions

Security or privacy questions: info@trackian.com.