Security and privacy, built in.
LinkTrail sits in the path between your ads, installs, and in-app screens. We treat that responsibility seriously — here's how we protect your data and your users'.
Last updated: 23 August 2026 · Version 1.0.
Where we stand on compliance
We'd rather tell you exactly what we have than imply more.
UK & EU GDPR
AlignedWe are a UK controller and processor, registered as LinkTrail Ltd in England and Wales. Our Data Processing Agreement applies automatically to every customer, needs no separate signature, and we'll sign a copy on request. It includes our full sub-processor list, our security measures in Annex II, and SCCs with the UK Addendum for restricted transfers.
CCPA & US state privacy laws
AlignedWe do not sell personal information and do not use it for cross-context behavioural advertising of our own. Consumer rights requests are handled at privacy@linktrail.io.
Annex II of the DPA is our substantive answer on security, measure by measure, and it marks which items are verified and which are commitments.
How we protect your data
Encryption in transit
All traffic is served over HTTPS with no plain-HTTP fallback; HTTP requests are permanently redirected. HSTS is enabled with a 180-day max-age including subdomains. We are not on the HSTS preload list.
Encryption at rest
The production database is encrypted with AES-256, covering primary and replica instances and all backups.
Least-privilege access
Production infrastructure and database access is limited to a small number of authorised personnel. Multi-factor authentication is enforced at organisation level across our hosting, source control and network providers, so an individual can't turn it off.
API key handling
Customer SDK keys are stored only as SHA-256 hashes. The plaintext key is shown once at creation and is never retrievable afterwards. Individual keys can be revoked at any time.
Isolated environments
Production, staging and development are separate, with separate credentials. Configuration is validated at startup, so the service fails to boot rather than running with a missing secret.
Audit trail
An immutable, append-only log records changes made through the dashboard — who, what, before and after. It is available to you in the dashboard on Growth and above.
Dependency hygiene
Automated dependency scanning runs on our repositories and alerts us to known vulnerabilities in third-party packages. We apply security updates on review.
Privacy by design — and where the trade-offs are
We don't use advertising identifiers. Our SDK never accesses the Apple IDFA, with or without App Tracking Transparency permission, and never reads the Google Advertising ID. Attribution works without them.
We do use device fingerprinting, and we say so. Where deterministic signals aren't available — no Google Play Install Referrer, no deferred click token — attribution can fall back to probabilistic matching: looking for a click with the same IP address and platform as the install, within a 7-day window. Those two fields are the whole comparison, the outcome is binary, and there is no confidence score. We still call it device fingerprinting. Under Article 5(3) ePrivacy and PECR regulation 6 it requires end-user consent, and Apple prohibits fingerprinting irrespective of ATT status.
So: our SDK is consent-gated by default — no device data is collected until your app signals consent — and probabilistic matching is off by default, switched on and off at workspace level. Section 9 of the DPA sets out the full analysis, including the controls available and their current limits.
We'd rather you make that decision with the facts than find out at App Store review.
We never sell customer or end-user data.
Retention. Raw click and install records are kept for 13 months, then deleted by an automated purge job. Aggregated reports, with no device identifiers, are kept for 3 years. Retention periods are fixed and set out in Annex I of the DPA; they aren't configurable per customer. The analytics history in your plan is a product feature, not the retention period.
Deletion. On termination or account deletion we start deleting straight away and clear your data from active production within 7 days — a controlled process rather than an instantaneous wipe, which is why it takes days rather than seconds. Account deletion is not reversible, so export anything you need before you terminate or within 7 days of it. Residual copies persist in encrypted backups until they expire, up to 12 months, and in debug logs until they expire at 90 days. Backups are used for disaster recovery only; neither store is searched or exported to serve a request.
Debug logging — what we capture
We log request and response bodies across all traffic for debugging and support, in Azure Application Insights in an EU region, with retention set explicitly to 90 days.
- Removed entirely before storage: passwords, tokens, API keys, two-factor codes.
- Masked: names, IP addresses, device identifiers.
- Retained in full: email addresses — so a support trace can be tied to an account.
That last point is a deliberate choice and we'd rather you read it here than discover it in an audit. It means an email address you send us in a deep link payload or event, or that appears in an API response, is retained unmasked for 90 days. Section 9.7 of the DPA sets out the detail. If that isn't acceptable for your use case, tell us at privacy@linktrail.io before you integrate.
Where your data lives
The European Union. Application, database and monitoring infrastructure all run in EU regions. We do not operate a US region. Several of our providers are US-parented, so their support and engineering staff may be able to access EU-stored data from outside the UK and EEA — where that's a restricted transfer, it's covered by the EU SCCs and the UK Addendum with a transfer risk assessment behind it.
Content delivery is the exception. Our CDN and DNS run on Vercel's global edge network, so every request is received at the node nearest the visitor — which may be anywhere in the world — then passed to our EU servers. The edge handles the connection and sees the visitor's IP. Link resolutions aren't cached at the edge; every click is resolved in the EU.
Our current sub-processors are Render (hosting, EU), Vercel (CDN and DNS, global edge) and Microsoft Azure Application Insights (monitoring, EU). Sentry is planned and not yet receiving data. The full list, with transfer notes, is Annex III of the DPA — published, not available-on-request.
Enterprise controls
- Role-based access control and team seat management.
- Immutable audit logs, available in the dashboard on Growth and above.
- Uptime commitment on the Scale plan — agreed in your order form, which sets out how availability is measured, what's excluded, and the remedy. No SLA or service credit forms part of our standard Terms of Service.
- SAML / SSO is built and not yet released. We'll list it here when it ships.
Security questions, answered
Which privacy laws does LinkTrail operate under?
UK and EU GDPR. We are a UK controller and processor, registered as LinkTrail Ltd in England and Wales. Our Data Processing Agreement applies automatically to every customer, needs no separate signature, and we'll sign a copy on request — it includes our full sub-processor list, our security measures in Annex II, and SCCs with the UK Addendum for restricted transfers. Under CCPA and US state privacy laws we do not sell personal information and do not use it for cross-context behavioural advertising of our own.
Where is LinkTrail data hosted?
In the European Union. Application, database and monitoring infrastructure all run in EU regions, and we do not operate a US region. Content delivery is the exception: our CDN and DNS run on Vercel's global edge network, so every request is received at the node nearest the visitor before being passed to our EU servers. Several of our providers are US-parented, so their staff may be able to access EU-stored data from outside the UK and EEA; where that is a restricted transfer it is covered by the EU SCCs and the UK Addendum with a transfer risk assessment behind it.
Who are LinkTrail's sub-processors?
Render for hosting in the EU, Vercel for CDN and DNS on a global edge network, and Microsoft Azure Application Insights for monitoring in the EU. Sentry is planned and not yet receiving data. The full list with transfer notes is Annex III of our DPA, published rather than available on request.
Does the LinkTrail SDK use the Apple IDFA or Google Advertising ID?
No. Our SDK never accesses the Apple IDFA, with or without App Tracking Transparency permission, and never reads the Google Advertising ID. Attribution works without them. Where deterministic signals aren't available it can fall back to probabilistic matching, which is device fingerprinting — it is consent-gated by default, off by default for a new workspace, and switched on and off at workspace level.
How does LinkTrail store API keys?
Customer SDK keys are stored only as SHA-256 hashes. The plaintext key is shown once at creation and is never retrievable afterwards. Individual keys can be revoked at any time.
Does LinkTrail sell customer or end-user data?
No. We never sell customer or end-user data, and we do not use personal information for cross-context behavioural advertising of our own.
How long does LinkTrail keep click and install data?
Raw click and install records are kept for 13 months, then deleted by an automated purge job. Aggregated reports, with no device identifiers, are kept for 3 years. Request and response bodies captured for debugging are kept for 90 days. Retention periods are fixed and set out in Annex I of the DPA; they aren't configurable per customer.
Report a vulnerability
Found something? Email security@linktrail.io. We investigate every report and won't pursue good-faith research. Security incidents are also the contractual notification route under section 12 of the DPA, where we commit to telling affected customers within 48 hours.