---
slug: sicherheit-architektur
title: "What security properties does Metrunio have?"
category: datenschutz
locale: en
updated: 2026-10-13
keywords: ["security","RLS","tenant separation","signature","redirect"]
questions: ["How is separation between customers enforced?","Security","Tenant separation","Row-level security","How secure is it?"]
url: https://bench.metrunio.com/en/help/sicherheit-architektur
---

# What security properties does Metrunio have?

**How is separation between customers enforced?**

Tenant separation is enforced in the database as well (row-level security), not only in application code. Tracking elements are signed, there is no open redirect, and signed requests are protected against replay.

- Consent state and purpose are stored and evaluated per event.
- Without matching consent no marketing event is stored, not even raw.
- No fingerprints, no circumvention of browser protections.
- No raw IP addresses; detected email addresses and phone numbers in measurement data are rejected, though the check does not detect every kind of personal data.
- User identifiers are pseudonymised per tenant.
- Tenant separation additionally through row-level security in the database.
- Signed tracking elements, no open redirect, replay protection.
- API keys are stored hashed only; a prefix stays visible.
- Every API route checks the required permission server-side.

> **Note:** Row-level security is the second layer: a tool that forgets its tenant filter still sees no foreign rows. Security therefore does not hang on the care taken in a single query.

## Also asked

- Security
- Tenant separation
- Row-level security
- How secure is it?

## Related

- https://bench.metrunio.com/en/help/site-id-und-write-key
- https://bench.metrunio.com/en/help/server-events-signatur
- https://bench.metrunio.com/en/help/rollen-und-rechte