Security, built into the script.
What Sadang does to protect your visitors' data, from the browser to our servers - and the certifications we do not hold yet.
In the browser.
Masked by default
Screenshots mask text by default. Session recording, which is in development, masks all text and every form input, and never records password or hidden fields.
Less in every request
Referrers are kept to the origin and path, query strings are removed from recorded URLs, and each event is capped at 20 KB.
Checked configuration
Add a checksum to your script tag and Sadang rejects a settings file that does not match it. Measurement data is sent only to your own site and the hosts your script tag allows.
One choice across tabs
When a choice changes, the visitor's other open tabs of the site apply it too.
Bot filtering
Known bots, automated browsers and implausibly fast interactions are filtered out, with rate limits on the server.
On our servers.
Regional deployments
Separate UK and Thailand deployments. Each site uses one, and its data is stored there - except what you choose to send to advertising platforms.
Hashed consent records
Consent receipts store a hashed visitor reference, not the reference itself.
Retention sweeps
Consent receipts expire after three years by default; screenshots are deleted by a daily sweep once the retention period you set has passed.
Consent checked twice
Advertising conversions are dropped on the server unless the visitor allowed marketing, even if the browser sent them.
Certifications.
We do not hold ISO 27001 or SOC 2 certification, and we are not yet a registered IAB TCF CMP or a Google-certified CMP (see our status). Our hosting provider, Amazon Web Services, holds its own certifications.
To report a security issue, email dpo@sadangattribution.com. Our security.txt has the same contact.