Docs/Security & Privacy

Security & Privacy Standards

Metrivo is built to minimize data collection and keep evidence scoped to the website and workspace that supplied it. Privacy and consent requirements still depend on your use case and jurisdiction.

Privacy-Friendly Web Tracking

Our embedded website tracker respects user choices and offers simple opt-out flags for your team and staging domains. It is separate from analytics used on Metrivo's own app and website.

Embedded website tracker

The tracker records page, event, and aggregate interaction evidence without session replay, DOM recording, keystroke capture, or raw input-value capture. It uses first-party anonymous visitor and session identifiers and does not track a visitor across customer websites.

Metrivo app and website analytics

Optional Amplitude analytics initializes only after explicit analytics consent. Autocapture and session replay are disabled. Essential operational error monitoring remains active to help keep the service reliable and is kept separate from optional analytics.

Respects Do Not Track (DNT)

If a user has set their browser to send a "Do Not Track" signal (`navigator.doNotTrack === "1"`), Metrivo immediately halts initialization. No network requests are made, and no tracking data is sent to our servers.

Developer and Team Opt-Out

To avoid skewing production analytics with team pageviews, you can set an opt-out key in browser storage:

localStorage.setItem("__metrivo_exclude", "1")

Staging and Demo Exclusion

Append `?metrivo_ignore=true` to any URL in your browser to prevent that specific session from sending events. This is ideal for manual QA testing or verifying staging link paths.

Cryptographic Data Protections

We apply industry-standard security steps to sensitive customer identities and credential records.

One-Way Email Hashing

We normalize and hash customer email addresses before writing them to analytics tables. This allows the engine to correlate payment and visitor evidence without storing the cleartext email in those records. Hashing is a data-minimization control, not a standalone compliance guarantee.

Secure API Key Management

Metrivo API keys are created with a secure prefix (for example, `key_`). The full secret token is shown only once; the database stores a one-way hash for later verification, reducing exposure if stored records are accessed.

Webhook Integrity

To prevent spoofing or replay attacks, Metrivo requires webhook payloads to be signed by the originating payment gateway (Stripe, Razorpay, or Dodo).

Signature Verification

When configuring webhook secrets, Metrivo validates the headers against each provider's cryptographic signing specifications. Any webhook containing an invalid or missing signature is immediately rejected with a `400 Bad Request` or `401 Unauthorized` status.

Next: Read the FAQ

Browse commonly asked questions regarding installation, attribution rules, and dashboard configurations.