Security
The safest data is the data we never collect.
This page describes how UserGuard handles data as a matter of product design — what a consent record contains, what it deliberately leaves out, and who on your account can reach it. Every line here is something you can check inside the app.
What a consent record contains
- The site the decision belongs to, and the exact banner version that was on screen
- The region the configuration resolved and the language actually rendered
- Whether a Global Privacy Control signal was present, and the per-category choice made
- A salted visitor hash, a truncated-then-hashed IP, the page URL and a UTC timestamp
What it deliberately doesn’t
- No name, no email, no account — nothing that identifies the visitor as a person
- No raw IP address. It is truncated before it is hashed, and the original is not the thing stored
- No browsing profile. The script records the consent decision, not what the visitor did next
- No selling or sharing of anything, ever — stated in the privacy policy and meant literally
Design decisions you can verify
Each row below is a property of the product rather than a promise about it. Open the Consent page, the Team page or the page source of your own site and you can confirm every one.
| Area | How it is built |
|---|---|
| The visitor identifier | A salted hash. It links a visitor’s own decisions into a coherent history — accepted in March, withdrew in June — without storing anything that identifies who the visitor is. |
| IP handling | The address is truncated first and hashed second. Enough to support the record, not enough to rebuild the person. |
| Proof of what was shown | Published banner configurations are immutable. Once a version is live it never changes, and every record points at the version that was on screen — so editing the banner later cannot rewrite what an old visitor agreed to. |
| The embedded script | One self-contained <script> tag with no dependencies and no second tag to add. It gates non-essential tags and writes the consent decision. It is not an analytics collector. |
| Access control | A four-role ladder from viewer to owner, applied across the account. Publishing a banner is member work; deleting a site is owner-only, because deleting unmakes the evidence. Archiving sits between them — a site’s records survive it. |
| Retention | Consent records are not kept forever, on purpose. The window is configurable per account and older records are pruned automatically; only an owner can change it. A consent log is there to demonstrate consent, not to become a permanent archive of visitor behaviour. |
| Getting your data out | The CSV export carries every record, with language and region on each row. A receipt in the app shows the exact fields the export contains — no summary layer, no fields held back. |
| Payment details | Card payment is handled by an external payment processor. Card numbers are not something UserGuard receives or stores. |
| Sub-processors | Named in the data processing addendum, which is still being written. |
What this page does not claim
Plenty of security pages list encryption standards, hosting regions, audit cadences and breach-notification windows. We would rather publish the handful of things you can check yourself than a longer list you have to take on faith. If you need written detail on our infrastructure or contractual commitments — because your own review process asks for it — write to hello@userguard.io and you will get a straight answer rather than a page that already assumed the answer.
The commitments that are contractual rather than editorial live in the data processing addendum. That is the document to hold us to.
Reporting a problem
If you find a vulnerability, write to hello@userguard.io with enough detail to reproduce it. We will keep you updated while we work on it, and credit you when it is fixed if you would like us to. We will not pursue legal action against anyone acting in good faith.
Please do not run automated scans against production, access another customer’s data, or degrade the service for anyone else while testing.
