Trust and compliance

This page consolidates the security, privacy, and reliability answers that procurement teams usually ask for. Where a formal document exists (privacy policy, terms of service, DPA on request), we link to it. Where we do not have a certification yet, we say so.

​

Where the platform runs

ABTestly runs entirely on Cloudflare’s global network.

• The dashboard, the marketing site, and the docs site are Cloudflare Pages projects.
• The API and the beacon endpoints are a Cloudflare Worker deployed to every location Cloudflare exposes.
• Config data lives in Cloudflare D1 (SQLite behind a global control plane).
• Fast reads live in Cloudflare KV and Durable Objects.
• Raw events are queued through Cloudflare Queues into R2 (S3-compatible object storage) and a per-experiment Durable Object. See Exact ledger.
• Live traffic counters use Cloudflare Analytics Engine.

There are no other clouds in the request path. Cloudflare handles TLS termination, DDoS protection, and the WAF for every hostname.

​

Subprocessors

The systems that touch customer data. Our privacy policy lists these subprocessors and is the authoritative source. If we add or replace one we update the policy and post a note in the changelog.

​

Data retention

Retention windows are set in our privacy policy §7.

​

Security posture

Transport. TLS 1.2 minimum on every hostname, HSTS on with 12-month max-age on abtestly.com and app.abtestly.com. Certificates are issued and rotated by Cloudflare. Authentication. Clerk handles email and social sign-in, MFA (TOTP and passkey), and session token issuance. Passwords never touch our infrastructure. Session JWTs are verified per request on the API. Authorization. Every write goes through a per-site permission check against a role plus per-key overrides. Twenty granular keys per member per site. See Members and roles. Isolation. Sites and organizations are separate rows in D1 with foreign-key scoping. Every query the API issues includes the org id from the verified JWT; there is no shared multi-tenant table where a missing filter would cross tenants. Snippet integrity. The runtime bundle served from cdn.abtestly.com/s is versioned. Config is signed with a site-specific key and validated against the configured domain at runtime, so a snippet lifted from one site cannot be used to pull another site’s configuration. Secrets. No third-party API tokens are ever sent to the browser. Worker secrets are stored in Wrangler’s secret store and rotated when a maintainer leaves the project. Vulnerability handling. Dependencies are scanned on every push. Critical CVEs on runtime dependencies are patched within seven days. Security-relevant fixes ship to production the same day they are merged. Reporting a vulnerability. Email security@abtestly.com. We do not run a bug bounty today. Responsible disclosure is welcome and we will credit you if you want to be credited.

​

Compliance certifications

We do not currently hold SOC 2, ISO 27001, or HIPAA certifications. When a certification exists we will publish the report and the audit letter here. Do not assume any certification that is not listed on this page. If you are evaluating ABTestly for a procurement process that requires one of these certifications and it would unblock you, tell us at enterprise@abtestly.com. We can share the security controls we do have in place and discuss what an accelerated audit would look like.

​

GDPR and UK GDPR

ABTestly Limited is registered in the United Kingdom and acts as a data processor for customer data handled through the platform.

• Lawful basis. Contract performance for customer data. Legitimate interest for analytics we run on our own site.
• Data subject rights. Access, correction, deletion, portability, restriction, objection, withdrawal of consent. Send requests to privacy@abtestly.com; we route them to the affected site owner and complete our part within thirty days.
• EU and UK representative. For EU and UK GDPR representative purposes we can be reached at privacy@abtestly.com. When our physical representative changes we will update the privacy policy.
• Data Processing Agreement. Available on request from enterprise@abtestly.com.

​

CCPA

For California residents:

• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising.
• Rights requests go to privacy@abtestly.com. We treat them the same as GDPR requests, on the CCPA timelines.

​

Consent and end-user data

The snippet supports two consent modes. See Install → Consent.

• always_on: the snippet activates immediately. Use this on sites where you already have consent through your CMP or where an A/B test does not constitute personal-data processing under your policy.
• deferred: the snippet waits for a positive signal from your CMP or from abtestly.grantConsent() before doing anything observable. If consent is never granted, the snippet fires nothing and no visitor hits your test.

Deferred fails closed. If your CMP crashes, the visitor is not enrolled and no data flows. Visitor opt-out is separate from consent, and always available at ?abtestly_optout=1 on any page. See Install → Visitor opt-out.

​

Uptime and incidents

Availability. We aim for high availability on a Cloudflare edge-native architecture, but our current terms of service do not include a formal Service Level Agreement. Verbatim from terms §9.3:

We do not currently offer a formal Service Level Agreement (SLA) with availability guarantees or service credits. Enterprise customers may negotiate a custom SLA.

If you need an SLA with defined uptime targets and credits, that is an Enterprise conversation, enterprise@abtestly.com. Failure modes we care about.

• Config fetch failure: the snippet returns without bucketing. The visitor sees the control page. No JavaScript error is thrown in the host page.
• Ledger backlog: the results page tells you the ledger is behind in plain English rather than serving stale numbers.
• Consent CMP failure in deferred mode: fail closed, snippet does nothing.
• Geo lookup miss: fail open, targeting rules that reference geo treat the visitor as unmatched for those rules only.

Incident communication. If we have a customer-visible incident we post a note at the top of app.abtestly.com and email affected orgs within two hours of detection. We do not run a public status page yet.

​

Payment data

We never see raw card data. Paddle acts as merchant of record. Card tokens are held by Paddle. We store the plan you are on, the price id you subscribed to, and the invoice history returned by Paddle. Refunds and cancellations are handled through Paddle’s flow; we mirror the webhook back into the dashboard. See refunds and cancellation for the customer-side flow.

​

Getting the paperwork

For a due-diligence packet (subprocessor list, retention grid, security controls, DPA template, insurance certificates when available) email enterprise@abtestly.com. We can turn most first-round questionnaires around inside a week.