Where data is stored
All analytics data is stored in the EU, in a Supabase project hosted on AWS in Stockholm (region eu-north-1). Supabase encrypts data at rest. All traffic to the dashboard, the tracking endpoints and the APIs uses HTTPS, and cortiq.se sends HSTS, so browsers only connect over HTTPS.
The marketing website cortiq.se is a static site hosted by Loopia in Sweden. It does not store analytics data.
How customers are kept apart
- Row-level security on every table. The database itself only returns rows for sites you own, regardless of what the application asks for.
- Privileged access only on the server. The key that bypasses row-level security exists only in server-side functions, never in the browser. Server functions that write on your behalf check that you own the site first.
- Database functions locked down. Functions that run with elevated rights cannot be called anonymously.
- Secrets out of reach. Google OAuth tokens and similar credentials are stored in columns the browser cannot read.
API keys and access
- API keys for the REST API and MCP server are stored only as SHA-256 hashes and shown once, when created.
- Each key reads exactly one site, read-only, and has its own rate limit. You can disable or delete a key at any time.
- Server-side fetches on your behalf (GEO audits, form detection) block private, loopback and cloud-metadata addresses.
Data minimisation
- Visitor analytics start only after analytics consent. Ad click IDs are stored only with marketing consent, which is checked on the server, not just in the browser.
- Heatmap points are stored without IP address or user agent, and with the page URL stripped of query strings.
- The Cloudflare Worker truncates IP addresses before anything leaves Cloudflare, and keeps nothing about human visitors except a count.
- Data is deleted automatically after the retention period set for each site. See the privacy policy for every retention period.
Subprocessors
Always used:
- Supabase (on AWS, Stockholm, EU): database, authentication and server functions.
Used only when you enable the related feature:
- Cloudflare (USA, EU-US Data Privacy Framework): the Cloudflare Worker and edge analytics.
- Google (USA): Google Analytics 4 and Search Console imports.
- Anthropic (USA): AI insights and GEO analysis, with your own API key.
- Resend (USA): when you send a report export by email.
The Data Processing Agreement sets out how we process personal data on your behalf, including breach notification within 72 hours.
Certifications
CortIQ itself does not hold ISO 27001 or SOC 2 certification. Our infrastructure provider Supabase is SOC 2 Type 2 audited. The full source code is public on GitHub, so you can review how data is handled.
Report a vulnerability
Email info@expandtalk.se with a description, steps to reproduce and the potential impact. Please do not open a public GitHub issue for security problems. We respond within 48 hours. Scope and details are in SECURITY.md.
Testing must not access other customers' data or degrade the service for others.