Privacy and security
What security properties does Metrunio have?
Tenant separation is enforced in the database as well (row-level security), not only in application code. Tracking elements are signed, there is no open redirect, and signed requests are protected against replay.
How is separation between customers enforced?
- Consent state and purpose are stored and evaluated per event.
- Without matching consent no marketing event is stored, not even raw.
- No fingerprints, no circumvention of browser protections.
- No raw IP addresses; detected email addresses and phone numbers in measurement data are rejected, though the check does not detect every kind of personal data.
- User identifiers are pseudonymised per tenant.
- Tenant separation additionally through row-level security in the database.
- Signed tracking elements, no open redirect, replay protection.
- API keys are stored hashed only; a prefix stays visible.
- Every API route checks the required permission server-side.
Note
Row-level security is the second layer: a tool that forgets its tenant filter still sees no foreign rows. Security therefore does not hang on the care taken in a single query.
Last reviewed on 13 Oct 2026
Also asked
- Security
- Tenant separation
- Row-level security
- How secure is it?
Related articles
- Where do I find the site ID, write key and server key?
Which key goes where, and which one may be public?
Site ID and write key are in the portal under “Setup” and belong in the browser tracking code. You create the server key in “Setup” on the “Server Events API” tab with “Create server key”; it is secret, belongs only in your backend and is shown in full only when it is created. Read keys for Claude and your own analyses are under “Exports & AI connections”, in the “API access” section.
- How do I sign server-side requests?
How does the HMAC signature and replay protection work?
Send the header x-metrunio-signature with a timestamp and an HMAC-SHA256 over "<timestamp>.<raw body>", computed with the server key. The time window is five minutes and each signature is accepted exactly once.
- Which roles exist and what may they do?
Who is allowed to do what in the portal?
There are three roles inside a tenant (Admin, Analysis and Read only) plus two platform-side roles. Every API route checks the permission server-side; hiding things in the interface is only the display of that.