Security controls for your team and data
Control who can access each website, protect your accounts and understand what your analytics collects. These are the safeguards built into Revfaro.
Tenant isolation
- Every website belongs to one workspace. Dashboard access is checked against workspace membership and site permissions.
- Dashboard requests for websites you cannot access return not found.
- Payment matching is scoped to the website and workspace.
Accounts and sign-in
- Passwords are hashed with Argon2id. Verification, reset and invitation tokens expire and are single use; authentication records store their hashes.
- Sign-in attempts are rate limited per address and per account. Email addresses must be confirmed before first sign-in.
- Session cookies are HttpOnly. You can sign out other devices, and resetting a password invalidates existing sessions.
Access control
- Owners and admins manage the workspace. Members can read all websites or receive viewer or manager access to selected sites.
- Read-only site viewers cannot access API keys or manage integrations. Site managers cannot administer the workspace or its billing.
- Owners and admins can review recent membership and site-access changes.
- Requests that change data from another website are refused, protecting signed-in users from cross-site attacks.
Privacy by design
- Visitor IP addresses are used during intake for approximate location, exclusions, rate limits and cookieless counting. Raw visitor IPs are not stored in analytics.
- The tracker removes fragments, URL credentials and known sensitive query parameters from page and referrer URLs before sending them. Avoid personal data in paths, campaign tags and custom properties.
- Locations are approximate, with coordinates rounded to about one kilometre. The standard script uses first-party cookies. Cookieless tracking stores no visitor identifiers on the device; an explicit opt-out choice is saved in local storage.
Payment data integrity
- Stripe, Lemon Squeezy, Polar and Dodo Payments webhook signatures are verified. Duplicate payment identifiers update the existing record instead of creating another payment.
- Deliveries that carry a signed timestamp (Stripe, Polar, Dodo Payments) are rejected when replayed late.
- Telegram payment updates forwarded by your bot server require a separate site secret. Bot tokens, chat messages and invoice payloads are not stored.
- Billing events are deduplicated and retained for a year as an audit trail.
- Signed checkout metadata is verified before a new subscription is bound to a workspace.
Infrastructure
- The web gateway applies security headers and a content security policy. Production deployments require HTTPS at the reverse proxy.
- The supplied deployment uses read-only web and API file systems, a non-root API process and unpublished database and cache ports. Operators must verify the deployed proxy and network configuration.
- Requests are rate limited at the edge and again in the application.
You stay in control of your data
Choose what you track, manage access and remove websites you no longer need. Your plan sets the analytics history window.
- Retention by plan
- Analytics older than your plan’s history window is deleted automatically.
- Deletion controls
- Deleting a website removes access immediately and queues its data for cleanup. Owners can also delete eligible workspaces.
- Your visitors, your data
- For visitor data you are the controller and we process it only to provide your analytics.
- Never sold
- We do not sell analytics data or use it for advertising.
Report a vulnerability
If you believe you have found a security issue, please tell us privately and give us a reasonable time to fix it before sharing it. Include the affected page and steps that help us understand the issue.
Start measuring what every channel earns
Add your website, connect your payments and start understanding the path to a customer.