hosted in the EU
How Rabolic handles your data.
Where your events are stored, who can see them, how sign-in is protected, and when data is deleted. Each answer here describes how the product works today.
- Servers in Germany
- IP addresses never stored
- Two-factor sign-in
- Hosting
- Germany (EU)
- Servers at Contabo
- In transit
- TLS on every host
- With HSTS
- Sign-in
- TOTP two-factor
- Can be required for everyone
- Backups
- Nightly
- To Cloudflare R2, Western Europe
Germany · EU
Where your data lives.
Your events, reports and account data are stored and processed in the EU. Only the TLS proxy takes traffic from the internet; the databases have no public port.
| What | Where |
|---|---|
| The dashboard, the API, ingest and the databases | One server in Germany (EU) at Contabo. Only ports 22, 80 and 443 are open; SSH takes keys only, and root login is off |
| The web SDK script | Cloudflare’s CDN, at cdn.rabolic.com. Websites load it from Cloudflare, not from the Rabolic server |
| Backups | Nightly, to Cloudflare R2 in Western Europe |
| Payments for Rabolic plans | Dodo Payments, the merchant of record. Rabolic never sees your card number |
https only
Encrypted in transit, secrets never in the clear.
The dashboard, the API and ingest are served over TLS with certificates from Let’s Encrypt, and send HSTS so browsers only ever use https. The SDKs send events over https.
Credentials are stored so that a copy of the database doesn’t reveal them:
| Data | How it is stored |
|---|---|
| Passwords | Hashed with scrypt. They can’t be read back |
| Two-factor secrets | Encrypted |
| API keys | As SHA-256 hashes. A secret key is shown once, when you create it. Publishable keys are public by design and stay readable |
| Invitation links | Their tokens as SHA-256 hashes |
| Payment provider webhook secrets | Encrypted with AES-256-GCM, and never returned by the API |
never collected
What Rabolic never keeps.
No IP addresses
Used to look up the country, region and city and to match your internal-traffic ranges, then dropped before anything is written.
No fingerprints
The SDKs never build a device fingerprint and never read advertising ids (IDFA, GAID) or the Android id.
No form fields
The SDKs don’t read form fields, the clipboard or location. Properties named like passwords, card numbers, CVVs, IBANs or social security numbers are dropped at ingest.
Projects kept apart
Every report query is scoped to one project, and people are never matched across projects.
roles · two-factor
Who can see and change what.
Every request is checked three ways: membership in the organization, access to the project, and the permission the action needs. Owners and admins see every project; analysts and viewers see the projects they are given.
- Sign in with email and password or Google
- TOTP two-factor, which owners and admins can require for everyone
- Passwords of at least 10 characters; sign-in attempts are rate-limited
- Sessions in httpOnly, SameSite=Lax cookies, with a CSRF check on every change
| Permission | Owner | Admin | Analyst | Viewer |
|---|---|---|---|---|
| See reports in their projects | ||||
| Create and edit reports | ||||
| Create and edit alerts | ||||
| Create and revoke SDK keys, connect payment providers | ||||
| Project settings, privacy requests, deleting a project | ||||
| Create projects | ||||
| Invite members, change roles and project access | ||||
| Organization settings, including requiring two-factor | ||||
| See usage and billing | ||||
| Change the plan, payment and caps | ||||
| Delete the organization |
Read from the same permission table the API enforces on every request.
retention_months
Kept as long as your plan says, then deleted.
Events, sessions and transactions carry your plan’s retention and are removed when they are older than that; people go once none of their events is left. When your plan changes, the new retention applies to the data already stored as well.
- Starter
- 12 months
- Growth
- 24 months
- Scale
- 36 months
- Business
- Agreed per contract
Deletion
| When | What is deleted |
|---|---|
| An event, session or transaction is older than your plan’s retention | That event, session or transaction |
| A person has no event left inside the retention | Their profile and identities, including people merged into them |
| Your plan’s retention gets shorter (a downgrade takes effect) | Everything older than the new retention, as above |
| You delete a person (a privacy request) | Their profile, identities, events and transactions, including people merged into them |
| You delete a project | Its events, sessions, people and transactions. Its keys stop working |
| You delete the organization | Every project in it, as above |
| A trial ends without a plan | The event data, 7 days later. The organization, members and projects stay |
| A canceled plan’s paid period ends | The event data, 30 days later |
Before data is deleted because a trial or plan ended, the owners get an email. Choosing a plan before then keeps everything.
privacy requests
Delete or export one person.
For your users’ GDPR and KVKK requests, an owner or admin can delete a person or export what Rabolic holds about them. A deletion removes their profile, identities, events and transactions, and those of the anonymous people merged into them. An export is a JSON file of their profile, identities and events.
Both work even when an organization is read-only, because answering them is a legal duty. For event data, Rabolic is your processor; for your account, its controller. The Privacy Policy has the details and the sub-processors.
Backups
The databases are backed up every night to Cloudflare R2 in Western Europe, with a key that can reach only that bucket. Old copies expire on their own.
Open-source SDKs
The code in your app is public under MIT at rabolic/sdks. Releases are built in GitHub Actions; npm packages carry provenance, and no publishing token is stored.
responsible disclosure
Found a vulnerability?
Please report it privately, not in a public issue. Include what is affected, what an attacker could do, and the steps to reproduce.
security faq
Security, answered.
Where is my data stored?
On Rabolic’s server in Germany, in the EU, at Contabo, with nightly backups to Cloudflare R2 in Western Europe. Only the web SDK script is served from Cloudflare’s CDN, so it loads fast everywhere.
Does Rabolic store IP addresses?
No. The ingest service uses a visitor’s IP address to look up the country, region and city and to check your internal-traffic ranges, then drops it. It is never written to the database. The lookup runs on Rabolic’s own servers against DB-IP’s IP-to-city database, so the IP isn’t sent to anyone.
Is Rabolic certified (SOC 2, ISO 27001)?
No. Rabolic holds no security certifications today. This page describes the controls that are in place, and you can ask support@rabolic.com about anything it doesn’t cover.
Can I require two-factor sign-in for my team?
Yes. Owners and admins can require two-factor for the organization. From then on, a member without it can’t open the organization until they turn it on in Account → Security. You need two-factor on your own account before you can require it.
How do I handle a GDPR deletion or access request?
An owner or admin can request the deletion or an export of one person. Deletion removes their profile, identities, events and transactions; the export is a JSON file of their profile, identities and events. Both work even when the organization is read-only, because they are a legal duty.
What happens to my data if I stop paying?
The dashboard becomes read-only and ingestion stops. The data is kept for 7 days after a trial ends and 30 days after a canceled plan’s paid period ends, then deleted, with an email 2 days before. Choosing a plan before then keeps it.
Who processes data for Rabolic?
Contabo (hosting), Cloudflare (CDN and backups), Dodo Payments (payments), Google (only if you sign in with Google) and an email delivery provider. The Privacy Policy lists them.
How do I report a vulnerability?
For the SDKs, report it privately on GitHub: the Security tab of rabolic/sdks, then Report a vulnerability. For the dashboard, the API or ingest, email support@rabolic.com. Please don’t open a public issue.
Product analytics, hosted in the EU.
Start a 3-day trial without a card. It begins with your first event, so you can set up the SDKs first.
- 1
Create a project
Sign up, name your project, and copy its publishable key.
- 2
Add an SDK
Web, React Native, Flutter or Node.js, or the HTTP API. Or run npx rabolic init.
- 3
Watch the first event arrive
It shows in live events within seconds, and your trial starts then.