Workspace boundaries
Each customer record is associated with its workspace. Authenticated server handlers authorize access, and the production database schema uses row-level policies to isolate workspace data. Owners control billing, connections, invitations, and destructive actions; members have narrower workspace access.
Public site IDs allow event ingestion only. They do not grant report access. Domain checks, request validation, rate limits, exclusions, and deduplication reduce invalid traffic; no browser analytics service can guarantee that a public collector receives only authentic human activity.
Payment and secret handling
Merchant webhooks require Stripe signature verification before payment facts are accepted. Event and Checkout identifiers prevent repeated delivery from multiplying recorded revenue. Separate routes and configuration handle VisitLift’s own subscription billing.
Merchant signing secrets are encrypted on the server. Service-role credentials, encryption keys, webhook secrets, and Stripe secret keys must never be exposed to the browser or committed to source control.
Data minimization
The tracker avoids arbitrary event properties, removes URL query strings/fragments from recorded paths, and does not intentionally store raw IP addresses or full user-agent strings in analytics storage. Persistent cross-visit attribution requires explicit activation through the consent interface.
Custom events and page paths can still contain sensitive content if an operator names them poorly. Exclude sensitive routes and verify your actual event payloads before installing broadly.
Production checklist
Use HTTPS, configure trusted origins and provider credentials, apply the supplied database schema/policies, enable scheduled retention/aggregation jobs, and verify email delivery. Local developer authentication must remain disabled in production.
Complete workspace-isolation tests, signed webhook retry tests, billing entitlement checks, backup/restore validation, and secret-redaction checks before opening public registration. Configure monitoring and an operational incident contact.
Honest limits
VisitLift does not claim SOC 2 certification, a third-party penetration test, guaranteed uptime, or independently audited compliance in this release. Provider security features do not automatically certify the application.
A vulnerability-reporting address and published response process must be configured by the production operator before general availability. Do not send live credentials or customer data through an unverified channel.