> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abtestly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust and compliance

> How ABTestly handles security, privacy, subprocessors, GDPR, retention, and uptime. Sourced from our public policies. Enterprise-track answers where they exist, honest gaps where they do not.

This page consolidates the security, privacy, and reliability answers
that procurement teams usually ask for. Where a formal document exists
(privacy policy, terms of service, DPA on request), we link to it.
Where we do not have a certification yet, we say so.

## Where the platform runs

ABTestly runs entirely on Cloudflare's global network.

* The dashboard, the marketing site, and the docs site are Cloudflare
  Pages projects.
* The API and the beacon endpoints are a Cloudflare Worker deployed to
  every location Cloudflare exposes.
* Config data lives in Cloudflare D1 (SQLite behind a global control
  plane).
* Fast reads live in Cloudflare KV and Durable Objects.
* Raw events are queued through Cloudflare Queues into R2 (S3-compatible
  object storage) and a per-experiment Durable Object. See
  [Exact ledger](/results/exact-ledger).
* Live traffic counters use Cloudflare Analytics Engine.

There are no other clouds in the request path. Cloudflare handles TLS
termination, DDoS protection, and the WAF for every hostname.

## Subprocessors

The systems that touch customer data.

| Subprocessor                       | Purpose                                    | Data location                    |
| ---------------------------------- | ------------------------------------------ | -------------------------------- |
| Cloudflare, Inc.                   | Compute, storage, CDN, DNS, DDoS, WAF      | Global (edge)                    |
| Clerk, Inc.                        | Account authentication, session tokens     | United States                    |
| Paddle.com Market Ltd              | Merchant of record, billing, tax, invoices | United Kingdom and United States |
| Functional Software, Inc. (Sentry) | Error and performance monitoring           | United States                    |

Our privacy policy lists these subprocessors and is the authoritative
source. If we add or replace one we update the policy and post a note
in the changelog.

<Note>
  We are a small startup and we intentionally keep the subprocessor
  list short. Every new one adds a data-flow surface we would have to
  document, an audit report to review, and a place a breach could
  originate.
</Note>

## Data retention

Retention windows are set in our
[privacy policy §7](https://abtestly.com/privacy).

| Category                                      | Retention                                                   |
| --------------------------------------------- | ----------------------------------------------------------- |
| Account records (org, sites, invoices)        | 30 days after account closure, then hard delete             |
| Experiment configuration and result summaries | 180 days in cold storage after account closure              |
| End-user exposure and event data (aggregated) | Aggregated forms retained for as long as the site is active |
| End-user exposure logs (raw, in the ledger)   | 90 days rolling window                                      |
| Team activity logs (audit trail)              | 24 months, then purged nightly                              |
| Sentry error events                           | 90 days                                                     |
| Support conversations                         | 3 years                                                     |

<Warning>
  The [Exact Experiment Ledger](/results/exact-ledger) is the canonical
  event store, and the raw rows in it obey the same 90-day rolling
  window. Results, verdicts, and per-day rollups are computed and
  persisted; those persist for the life of the experiment. If you need
  the raw event stream for an audit, run the
  [async export](/results/exports) inside the 90-day window and pull
  the CSV to your own storage.
</Warning>

## Security posture

**Transport.** TLS 1.2 minimum on every hostname, HSTS on with 12-month
max-age on abtestly.com and app.abtestly.com. Certificates are issued
and rotated by Cloudflare.

**Authentication.** Clerk handles email and social sign-in, MFA (TOTP
and passkey), and session token issuance. Passwords never touch our
infrastructure. Session JWTs are verified per request on the API.

**Authorization.** Every write goes through a per-site permission check
against a role plus per-key overrides. Twenty granular keys per member
per site. See [Members and roles](/team/members-and-roles).

**Isolation.** Sites and organizations are separate rows in D1 with
foreign-key scoping. Every query the API issues includes the org id
from the verified JWT; there is no shared multi-tenant table where a
missing filter would cross tenants.

**Snippet integrity.** The runtime bundle served from
`cdn.abtestly.com/s` is versioned. Config is signed with a
site-specific key and validated against the configured domain at
runtime, so a snippet lifted from one site cannot be used to pull
another site's configuration.

**Secrets.** No third-party API tokens are ever sent to the browser.
Worker secrets are stored in Wrangler's secret store and rotated when
a maintainer leaves the project.

**Vulnerability handling.** Dependencies are scanned on every push.
Critical CVEs on runtime dependencies are patched within seven days.
Security-relevant fixes ship to production the same day they are
merged.

**Reporting a vulnerability.** Email `security@abtestly.com`. We do
not run a bug bounty today. Responsible disclosure is welcome and we
will credit you if you want to be credited.

## Compliance certifications

We do not currently hold SOC 2, ISO 27001, or HIPAA certifications.
When a certification exists we will publish the report and the audit
letter here. Do not assume any certification that is not listed on
this page.

If you are evaluating ABTestly for a procurement process that requires
one of these certifications and it would unblock you, tell us at
`enterprise@abtestly.com`. We can share the security controls we do
have in place and discuss what an accelerated audit would look like.

## GDPR and UK GDPR

ABTestly Limited is registered in the United Kingdom and acts as a
data processor for customer data handled through the platform.

* **Lawful basis.** Contract performance for customer data.
  Legitimate interest for analytics we run on our own site.
* **Data subject rights.** Access, correction, deletion, portability,
  restriction, objection, withdrawal of consent. Send requests to
  `privacy@abtestly.com`; we route them to the affected site owner
  and complete our part within thirty days.
* **EU and UK representative.** For EU and UK GDPR representative
  purposes we can be reached at `privacy@abtestly.com`. When our
  physical representative changes we will update
  [the privacy policy](https://abtestly.com/privacy).
* **Data Processing Agreement.** Available on request from
  `enterprise@abtestly.com`.

## CCPA

For California residents:

* We do not sell personal information.
* We do not share personal information for cross-context behavioral
  advertising.
* Rights requests go to `privacy@abtestly.com`. We treat them the
  same as GDPR requests, on the CCPA timelines.

## Consent and end-user data

The snippet supports two consent modes. See
[Install → Consent](/install/consent).

* `always_on`: the snippet activates immediately. Use this on sites
  where you already have consent through your CMP or where an A/B
  test does not constitute personal-data processing under your policy.
* `deferred`: the snippet waits for a positive signal from your CMP or
  from `abtestly.grantConsent()` before doing anything observable. If
  consent is never granted, the snippet fires nothing and no visitor
  hits your test.

Deferred fails closed. If your CMP crashes, the visitor is not
enrolled and no data flows.

Visitor opt-out is separate from consent, and always available at
`?abtestly_optout=1` on any page. See
[Install → Visitor opt-out](/install/opt-out).

## Uptime and incidents

**Availability.** We aim for high availability on a Cloudflare
edge-native architecture, but our current terms of service do not
include a formal Service Level Agreement. Verbatim from
[terms §9.3](https://abtestly.com/terms):

> We do not currently offer a formal Service Level Agreement (SLA)
> with availability guarantees or service credits. Enterprise
> customers may negotiate a custom SLA.

If you need an SLA with defined uptime targets and credits, that is
an Enterprise conversation, `enterprise@abtestly.com`.

**Failure modes we care about.**

* **Config fetch failure**: the snippet returns without bucketing.
  The visitor sees the control page. No JavaScript error is thrown
  in the host page.
* **Ledger backlog**: the results page tells you the ledger is behind
  in plain English rather than serving stale numbers.
* **Consent CMP failure in deferred mode**: fail closed, snippet does
  nothing.
* **Geo lookup miss**: fail open, targeting rules that reference geo
  treat the visitor as unmatched for those rules only.

**Incident communication.** If we have a customer-visible incident we
post a note at the top of `app.abtestly.com` and email affected orgs
within two hours of detection. We do not run a public status page yet.

## Payment data

We never see raw card data. Paddle acts as merchant of record. Card
tokens are held by Paddle. We store the plan you are on, the price id
you subscribed to, and the invoice history returned by Paddle. Refunds
and cancellations are handled through Paddle's flow; we mirror the
webhook back into the dashboard.

See [refunds and cancellation](/billing/refunds) for the customer-side
flow.

## Getting the paperwork

For a due-diligence packet (subprocessor list, retention grid,
security controls, DPA template, insurance certificates when available)
email `enterprise@abtestly.com`. We can turn most first-round
questionnaires around inside a week.