Skip to content
Personyze
Book a demoStart free

Trust & security

Security at Personyze

Personyze personalizes websites for companies that trust it with their visitors’ data. This page explains where that data lives, who can reach it, how it is protected, and how you decide what is kept.

Contact the teamRequest the DPA

Last updated 5 October 2026 · security.txt

Where your data lives

Personyze runs on Amazon Web Services (AWS) infrastructure. Personyze data is not hosted anywhere else.

It benefits from AWS’s physical and network security: guarded, access-controlled data centers, redundant power and networking, and continuous monitoring by AWS.

Your data is kept separate

Each customer’s data — tracking data, visitor profiles and campaign results — is stored in its own separate database tables. It is never mixed with another customer’s data.

Who can access your account

No one at Personyze enters a customer’s account except the customer’s account manager — and only with the customer’s permission.

  • Every Personyze team member signs a non-disclosure agreement (NDA).
  • Access inside Personyze is limited to the people who need it for their role.
  • In your own account, roles and permissions decide what each team member can see and change.

Secure sign-in for your team

Microsoft Entra IDOktaOneLoginAuth0or any OpenID Connect provider
  • Two-step sign-in on every plan: a code from an authenticator app — Google Authenticator, Microsoft Authenticator, 1Password or any standard app — or an emailed code for people without one.
  • Account owners can require two-step sign-in for the whole team. An owner can reset a member who lost their phone, and the member is emailed that it happened.
  • Ten one-time recovery codes for a lost phone, shown once and stored only as one-way hashes. Authenticator secrets are encrypted with AES-256-GCM.
  • Single sign-on (SSO) through your own identity provider (OpenID Connect), or a Google or Microsoft work account. These sign-ins rely on your provider’s own second step.
  • Passwords are never stored in readable form; they are protected with bcrypt hashing.
My profile · Two-step sign-inAuthenticator app
1Scan the code with your authenticator app
2Then type the 6-digit code it shows
482913
Two-step sign-in is on

Or emailed codes, for people without an app

Team members · Sign-in security
Required for everyoneEach unfamiliar browser is confirmed with a code
On
Recovery codesOne-time codes for a lost phone
10 left
Sign-in alertAn email after each sign-in from an unfamiliar browser
On
Rate limitFive wrong codes lock the code step for the hour
5 an hour
Remembered browserAsked for a code again after
30 days

Encryption in transit

The Personyze dashboard, the API and the tracking code are served over HTTPS.

Plain HTTP requests to the dashboard and the API are redirected to HTTPS.

Privacy by design

You decide what the tracking code collects.

  • A standard Personyze setup needs no personal details: visitors are recognized by a pseudonymous cookie ID. Personal details are added only if you choose to send them — for example, from a form or a login.
  • Visitor IP addresses are used to find location and are not stored in visitor profiles.
  • Wait for consent before tracking, with ready-made instructions for Cookiebot, OneTrust, Usercentrics, IAB TCF and Google Consent Mode.
  • Honor the Global Privacy Control signal.
  • Keep emails and tokens out of the page addresses Personyze records.
  • First-party cookies only, and you choose the visitor cookie’s lifetime, from 30 days to 2 years.
  • Data Processing Agreement (DPA): available on request — write to support@personyze.com.

Data retention, set by you

Decide how long Personyze keeps each kind of visitor data.

  • A period for each kind: known visitors’ profiles, cookie-only profiles, visit history, form submissions, survey and review answers, email activity, chat transcripts and meeting bookings.
  • Periods can be shorter than our defaults, down to 30 days for known profiles.
  • A safety net: shortening a period waits 7 days, shows how many records will go, and can be cancelled.
  • When a customer cancels, their data is deleted within 90 days.

Visitor requests, in minutes

Find, export and delete a person’s data across Personyze.

  • One search covers profiles, visits, forms, surveys, chats, meetings and email activity. The export is a JSON file.
  • A receipt and an audit log of every request. The receipt says what was removed, what was kept and why — an address stays on your suppression list, so that person is never emailed again.
  • It helps you meet GDPR access and erasure requests and CCPA deletion requests. Copies already sent to your connected tools, such as a CRM, are handled there.

Not sure where to start? An AI advisor suggests the settings.

It looks at where your visitors actually come from and what kind of site you run, and links every suggestion to the regulator’s own page. Apply them in one click — they are suggestions, not legal advice.

CNIL · FranceEuropean CommissionICO · UKCPPA · CaliforniaCAI · QuebecANPD · BrazilFTC · US

Testing and monitoring

  • Penetration testing every month.
  • Automated monitoring and alerting on Personyze’s services.

If something happens

If a security incident affects a customer’s data, Personyze notifies that customer without undue delay, as GDPR requires.

Sub-processors

Sub-processorPurpose
Amazon Web Services (AWS)Hosting and data storage

The current list is available on request at support@personyze.com.

Report a vulnerability

Found a security issue? Email support@personyze.com with the details. We investigate every report and reply to the person who reported it. Please don’t publicly disclose an issue before we’ve had a chance to fix it.

Report an issue/.well-known/security.txt

Questions

Security questions, answered

Where is Personyze data hosted?
On Amazon Web Services (AWS) infrastructure. Personyze data is not hosted anywhere else.
Does Personyze need personal data to work?
No. A standard setup recognizes visitors by a pseudonymous cookie ID. Personal details are added only if you choose to send them, for example from a form or a login. Visitor IP addresses are used to find location and are not stored in visitor profiles.
Can Personyze staff see our account?
Only your account manager, and only with your permission. Every team member signs a non-disclosure agreement, and access inside Personyze is limited to the people who need it for their role.
Do you sign a Data Processing Agreement?
Yes. The DPA is available on request — write to support@personyze.com.
How long do you keep our visitors’ data?
You set it. Each kind of data — profiles, visit history, form submissions, survey and review answers, email activity, chat transcripts and meeting bookings — can have its own period, shorter than our defaults and down to 30 days for known profiles. Shortening a period waits 7 days and can be cancelled.
Can we delete one visitor’s data?
Yes. Find, export and delete a person’s data across Personyze, with a receipt and an audit log of every request. The export is a JSON file, and the receipt lists what was removed, what was kept and why.
Do you honor Global Privacy Control?
Yes, once you turn it on: Personyze then honors the Global Privacy Control signal and does not record visits from browsers that send it.
What happens to our data if we cancel?
It is deleted within 90 days of cancelling.
Which sign-in options does Personyze support?
Single sign-on through Microsoft Entra ID, Okta, OneLogin, Auth0 or any OpenID Connect provider; Google or Microsoft work accounts; two-step sign-in with an authenticator app or emailed codes, which an account owner can require for the whole team; and roles and permissions for each team member.
Can we send you a security questionnaire?
Yes. Send it to support@personyze.com, together with anything else your review needs, and the team will work through it with you.

Doing a security review?

Send us your questionnaire, ask for the DPA or the current sub-processor list, or ask about anything this page does not cover. The team will answer.

Contact the teamBook a demo