Trust / Last reviewed
Security
What we do to protect your account and your analytics data, and how to tell us about a problem. This page lists only measures that are in place today.
Accounts
- Passwords of at least 10 characters, stored only as scrypt hashes.
- Two-factor sign-in with an authenticator app, with one-time backup codes.
- Email addresses are verified before an account can be used.
- Setting a new password signs out every other session.
- Sign-in, sign-up, password reset and two-factor checks are rate limited.
- Workspace roles (owner, admin, analyst, viewer, client viewer) decide who can change settings, invite people or export data.
Keys and links
- API keys, ingest keys and share links are shown once and stored only as SHA-256 hashes.
- API keys can be limited to some sites, and revoking one takes effect on the next request.
- Shared dashboards can be password-protected and revoked at any time.
Data
- All data is stored and processed on servers in the EU. The full list is on the sub-processors page.
- Visitor IP addresses are used in memory and never written to a database, a log or a backup.
- Server logs carry no IP addresses and no request headers.
- On every change, an automated test sends a unique IP address and browser string, then searches every database and log for them. If it finds either, the change is rejected.
- Each site has its own retention period between 1 and 25 months. Deleting a site removes its events within about ten minutes.
Web
- HTTPS only, with HTTP Strict Transport Security.
- No third-party scripts, fonts or trackers on nordtally.com or in the app. A Content Security Policy enforces this, with a per-request nonce on signed-in pages.
- Pages can’t be framed by other sites, except shared dashboards that are meant to be embedded.
Reporting a vulnerability
Email hello@nordtally.com with what you found and how to reproduce it. We reply within three working days and keep you updated until it’s fixed.
- Use your own account and test sites; don’t access other people’s data.
- Don’t run denial-of-service tests or send automated traffic at volume.
- Give us a reasonable time to fix the issue before you publish it.
If you follow these rules in good faith, we won’t take legal action against you, and we’re happy to credit you once the fix is out. There is no paid bug bounty at the moment. Our security.txt has the same contact details.