Security Overview

This page describes controls that can be verified in the AttribIQ repository. It is not a certification, audit report, service-level agreement, penetration-test summary, or complete description of the production environment.

Contact privacy@attribiq.com to confirm the operational controls, evidence, and disclosure process relevant to your procurement or security review.

API keys are hashed at rest and scoped per project.

Public documentation treats browser attribution values as client-provided reporting context. Payment amounts, plan access, account ownership, and other billing decisions must be validated by the customer’s server.

Stripe webhook signatures are verified when the endpoint secret is configured. Production deployments should configure the secret and preserve signature verification.

Stripe delivery IDs and stable Payment API transaction identifiers support idempotent handling. This prevents a repeated delivery from being counted as a new revenue event when the same durable identifier is reused.

Analytics event rows use country-level location data rather than storing a raw-IP field. Network and security logs are a separate operational system and should be reviewed under the applicable retention policy.

The ingest sanitizer removes common property keys associated with personal data. Customers must still avoid sending sensitive or unnecessary values in URLs, event names, and custom properties.

Prometheus metrics cover ingest volume, event-store writes, spool backlog, worker failures, API latency, and webhook failures. Metrics support operational visibility; they do not by themselves establish an incident-response or uptime commitment.

Encryption at rest, key rotation, backup controls, tenant-isolation testing, administrative access, incident response, vulnerability disclosure, and subprocessor controls must be confirmed against the production environment before they are used in a contractual or compliance statement.