Security
Security built into the data layer.
Customer data is the whole product, so the controls are not a policy page bolted on afterwards. Here is exactly what is in place today, and what is not.
Consent
The decision happens before the data moves.
Which rule applies depends on where the visitor is, and it is evaluated on every single event. This is the actual branch the edge takes, not a summary of it.
An event reaches the edge
The visitor's country comes from the edge network, not from the page
Nothing is dispatched without an explicit yes.
No signal, or an explicit no
The event is discarded at the edge. Nothing reaches any destination.
Explicit yes
The event continues to identity resolution and dispatch.
Dispatched unless the visitor has said no.
Explicit no
The event is discarded at the edge, exactly as in the EU.
Global Privacy Control, or a US Privacy opt-out
The event is still dispatched, but under Limited Data Use on Meta and TikTok, with ad consent denied on Google, and with no plaintext email to any CRM.
No objection
The event continues to identity resolution and dispatch.
Only what got through
Hashed, then sent
Email and phone become SHA-256 digests before an advertising platform sees them.
Plaintext stays put
It only reaches the CRM and warehouse destinations you connected yourself.
Encrypted in transit
Every request, from the visitor to the edge and from the edge to each destination, travels over TLS. There is no plaintext hop in the path.
Secrets stay server-side
Destination credentials are stored server-side and never reach the browser. The tracking script carries a public project token and nothing else.
Signed cookies and state
Session cookies are signed with HMAC-SHA256 and set Secure and HttpOnly. OAuth state is signed too, so an authorization flow cannot be replayed against your account.
Hashed before advertising egress
Email and phone are hashed with SHA-256 before any advertising platform receives them. Plaintext personal data only reaches CRM and warehouse destinations you connect deliberately.
Database reachable only from the backend
No client talks to the database directly. Internal APIs are protected by tokens, and row-level access is scoped to the owning account.
Personal data redacted in logs
Identifiers are truncated or removed before anything is written to a log, so an operational trace never becomes a second copy of your customer list.
Consent enforced at the edge
Consent is evaluated per request in the region closest to the visitor and decides whether the event is dispatched at all. Opt-in for the EU, EEA, UK and Switzerland; opt-out and Global Privacy Control honoured elsewhere.
Deletion you can run yourself
Erase all tracking data for a website or for the entire account from settings. It runs immediately across every store, without a support request.
What we do not claim, while we are in beta
SetRoasFlow is in open beta. We hold no SOC 2 report, no ISO 27001 certification and no PCI attestation, and we do not offer an uptime SLA or enterprise support commitments. We do not process card data at all: payments, when they open, run through a payment provider and card details never touch our systems. If a certification is a requirement for you today, tell us and we will say plainly where we stand rather than leave it ambiguous.
Documents
Found something that looks wrong? Write to [email protected]. We would rather hear it from you than read about it later.
Ready to own your customer data?
Create your account, add the script or install the app, and your first customer profiles start forming today. Free while in beta.