Database and compute in Amsterdam, consent required by default.

Database and compute in Amsterdam, with Scaleway, in the European Union.

The database and the application that receives events run in the same place. Each service that processes data is listed below, with its location when specified. Depending on the feature used, Mistral may temporarily transfer data outside the European Union to the subprocessors it publishes; its data processing agreement limits these transfers to countries the EU recognizes as adequate, or covers them with standard contractual clauses. Stripe transfers payment data to Stripe, LLC, in the United States, under the Data Privacy Framework and, failing that, standard contractual clauses. Whatever region is chosen, Sentry may keep the data of Probant’s Sentry account (members, settings, audit log, project descriptions) in the United States; reported errors stay in Frankfurt.

• Scaleway Always active

  Hosting of the website and the application, including event collection; database; storage of images uploaded from the editor; domain names.

  Location: Amsterdam, Netherlands (nl-ams region), in the European Union

• Brevo Always active

  Sending Probant’s emails: sign-in emails (address confirmation, forgotten password), support emails (reply notification, alert to the team), alerts for workspaces that have an “Email” destination, and the Monday update for people who receive it.

  Location: European Union: servers in France and Germany, encrypted backups in Belgium (Google Cloud), according to Brevo

• Mistral AI Optional

  Language model behind the editor assistant, “Ask Probant”, and session summaries; optional, available to signed-in users only.

  Location: European Union by default (European API endpoint), according to Mistral

  Depending on the feature used, Mistral may temporarily transfer data outside the European Union to the subprocessors it publishes; its data processing agreement limits these transfers to countries the EU recognizes as adequate, or covers them with standard contractual clauses.

• ClickHouse Optional, not in use

  Optional storage for visitor events, replacing the Postgres table when volume requires it.

  Location: Option not in use: it is not connected in production, and visitor events stay in the Postgres database, at Scaleway, in Amsterdam.

• Stripe Optional

  Payment for paid plans: checkout page, subscription, invoices, payment method, and cancellation (Stripe portal).

  Location: Contract with Stripe Payments Europe, Ltd. (Ireland); data transferred to Stripe, LLC (United States), according to Stripe

  Stripe transfers payment data to Stripe, LLC, in the United States, under the Data Privacy Framework and, failing that, standard contractual clauses.

• Sentry Optional

  Optional reporting of server errors, so they can be fixed.

  Location: European Union: Frankfurt (Germany), including backups, according to Sentry

  Whatever region is chosen, Sentry may keep the data of Probant’s Sentry account (members, settings, audit log, project descriptions) in the United States; reported errors stay in Frankfurt.

Visitor’s country: when an audience or a geo test uses it, and only then, it is read from the request’s IP address, using a table kept inside the application. The address is neither stored nor sent to a third party. IP Geolocation by DB-IP.

The data involved, service by service: subprocessors.

The script waits for consent.

Requiring consent is a workspace’s default setting. The visitor’s choice is passed on every page, as soon as your consent tool knows it.

// accepted: assignment and measurement, without switching the page on screen
probant.consent(true);
// refused or withdrawn: cookie and local traces deleted
probant.consent(false);

Events are deleted after 13 months.

An event records that a visitor came, saw a variant, converted, or measured something, with the context of their visit.

Encryption, backups, incidents.

What is established today, and what remains to be specified.

Encrypted secrets

Two-factor keys and backup codes are encrypted with the sign-in key. Integration secrets (Shopify and Stripe webhooks) and alert destinations are encrypted with AES-256-GCM and bound to their workspace: copied to another workspace, they cannot be decrypted.

Error reporting

When error reporting is on (Sentry), no headers, cookies, or request bodies are sent; email addresses and API keys are masked in messages.

Encryption in transit

The app, the API, and the script respond only over HTTPS; the app’s connection to the database requires TLS.

Stored sensitive data

Passwords are hashed (scrypt), and API keys and access tokens are stored as SHA-256 hashes, never in plain text. Disk encryption at the hosting provider is not yet specified in Probant’s documents.

Backups

Automatic database backups are enabled at the hosting provider. Their frequency, retention period, and exact location are not published yet.

Incident or breach

In the event of a data breach, Probant notifies the customer without undue delay after becoming aware of it, as the GDPR requires (Article 33) and the data processing agreement restates. A specific deadline and the detailed procedure are not set yet.

Security contact

Report a vulnerability or incident to contact@clivio.app; we reply within 48 hours. The same address is published in /.well-known/security.txt.