Security
What we store, and what we leave out.
This page describes how UserGuard handles data by design: what a consent record contains, what it leaves out, and who on your account can reach it. You can check most of it inside the app.
What a consent record contains
- The site the decision belongs to, and the exact banner version that was on screen
- The region the configuration resolved and the language the banner was shown in
- Whether a Global Privacy Control signal was present, and the per-category choice made
- A salted visitor hash, a truncated-then-hashed IP, the page URL and a UTC timestamp
What it leaves out
- No name, email or account, and nothing else that identifies the visitor as a person
- No raw IP address. We truncate it before hashing it, and we don’t store the original
- No browsing profile. The script records the consent decision and doesn’t record what the visitor did next
- No selling. We don’t sell this data or pass it to advertisers, and the privacy policy says the same for this website
Design decisions you can verify
Each row below describes how the product works. You can check most of them yourself on the Consent page, the Team page or your own site’s page source. IP handling and card payments happen on servers you can’t see, so for those two you’re taking our word.
| Area | How it is built |
|---|---|
| The visitor identifier | A salted hash. It links a visitor’s own decisions into one history, like accepting in March and withdrawing in June, without storing anything that identifies who the visitor is. |
| IP handling | We truncate the address first and hash it second. That keeps enough to support the record but not enough to work back to the person. |
| Proof of what was shown | Published banner configurations are immutable. Once a version is live it never changes, and every record points at the version that was on screen. If you edit the banner later, that can’t rewrite what an earlier visitor agreed to. |
| The embedded script | One self-contained <script> tag with no dependencies and no second tag to add. It holds non-essential tags and writes the consent decision. It isn’t an analytics collector. |
| Access control | There are four roles, from viewer to owner, applied across the account. Members can publish a banner. Only an owner can delete a site, because deleting it destroys the evidence. Archiving sits between the two, and a site’s records survive it. |
| Retention | We don’t keep consent records forever. You can configure the window per account, older records are pruned automatically, and only an owner can change the window. A consent log is there to demonstrate consent, and we don’t want it turning into a permanent archive of visitor behavior. |
| Getting your data out | The CSV export carries every record, with language and region on each row. A receipt in the app shows the exact fields the export contains, with nothing summarized or held back. |
| Payment details | An external payment processor handles card payments. UserGuard doesn’t receive or store card numbers. |
| Sub-processors | Named in the data processing addendum, which is still being written. |
What this page does not claim
Plenty of security pages list encryption standards, hosting regions, audit cadences and breach-notification windows. We’d rather publish the handful of things you can check yourself than a longer list you have to take on faith. If your own review process needs written detail on our infrastructure or contractual commitments, write to hello@userguard.io and we’ll give you a straight answer.
We haven’t finished our data processing addendum yet. It’s an outline for now, and nothing in it binds anyone.
Reporting a problem
If you find a vulnerability, write to hello@userguard.io with enough detail to reproduce it. We will keep you updated while we work on it, and credit you when it is fixed if you would like us to. We will not pursue legal action against anyone acting in good faith.
Please do not run automated scans against production, access another customer’s data, or degrade the service for anyone else while testing.
