Security policy

Last updated: November 5, 2026

Plerdy helps website owners understand how visitors use their websites. Our clients trust us with their account data and with data about the visitors of their websites. This page explains how we protect that data, what we do if something goes wrong and how to report a security issue.

Our role

Client account data (name, email, billing): Plerdy is the controller.
Website visitor data collected by the Plerdy code on a client's website: the client is the controller, and Plerdy processes this data only on the client's instructions, as a processor, under our Data Processing Agreement. It applies automatically to all clients.

Infrastructure

Plerdy servers, databases and session-recording storage are hosted in Germany, in ISO/IEC 27001-certified data centres.
Traffic to Plerdy passes through a content delivery network that provides encryption and protection against attacks.
Data in transit is encrypted with TLS.
Our subprocessors are listed in the DPA.

Privacy by default

Values typed into form fields are masked in the visitor's browser before anything is sent to Plerdy. Password, email, phone, name and address fields are always masked.
Elements marked as sensitive or payment-related are not recorded.
Session recordings reproduce the page structure and the visitor's actions. They are not video or screenshots.
Form analytics records how fields are used, never what is typed in them.
Visitor IP addresses are used only at the moment of the request, to determine the country and to apply the client's IP exclusion list. They are not stored in tracking data.
Plerdy does not collect data from browsers that send Global Privacy Control or Do Not Track. Clients can load the Plerdy code only after the visitor's consent.

Access and accounts

Access to production systems and client data is restricted to authorised team members who need it for their work.
Client passwords are stored only as salted one-way hashes (bcrypt). Nobody at Plerdy can see them.
Clients can turn on two-step login with a one-time code sent by email.
Repeated failed login attempts are limited.
Payments are processed by Paddle. Plerdy does not receive or store payment card numbers.

Tracking code integrity

The Plerdy tracking script is built automatically from our version-controlled source code and is not edited by hand on servers.

Our team

Everyone with access to personal data is bound by confidentiality and is trained to recognise phishing and to report security incidents.

Incident response

If we detect a security incident, we stop it, investigate what happened and which data was affected, involve the national CERT where appropriate and fix the cause.

We notify affected clients without undue delay and, where possible, within 48 hours, so that they can meet their own obligations. Where the law requires it, we notify the supervisory authority within 72 hours and inform affected people directly.

Security incidents: August–September 2026.

Reporting a vulnerability

If you believe you have found a security vulnerability in Plerdy, email [email protected] with a description and steps to reproduce it. We confirm receipt within 3 business days. Please do not access other users' data or disrupt the service, and give us reasonable time to fix the issue before disclosing it. We will not take legal action against good-faith research that follows these rules.

Shared responsibility

Clients are responsible for keeping their login details confidential, giving access only to trusted team members and informing their website visitors about the use of Plerdy in their own privacy notice.