Security

Trackneat runs on your clients' websites. That's why we describe here, as concretely as we can, how we secure it. No provider can honestly guarantee that nothing will ever happen. This is what we do.

Last reviewed: 9 October 2026

The beacon on your clients' sites

  • It only counts how often tags like Meta Pixel, GA4 or TikTok fire, per platform and event name.
  • It sets no cookies, reads no form fields or page content and sends no user identifiers. Only daily counters per site end up in our database.
  • It calls the tags' original functions unchanged and catches its own errors, so it can't break your client's site.
  • Every site has its own public key. It isn't a secret, but it stops anyone from injecting counts into other sites by guessing numbers.
  • The script is served directly from trackneat.com. You can read the code in your browser at any time.

The checks

  • We open your clients' sites from our server in Germany with a real browser, like a normal visitor. We never log in anywhere and only see what any visitor sees.
  • The check browser can only reach public websites. Our server's internal services are blocked for it, even if a page tries to redirect it there.
  • Our visit shows up in the checked site's statistics, for example as a page view. With a real browser that can't be avoided.

Servers and infrastructure

  • Server and database run at Hetzner Online GmbH in the Falkenstein data centre in Germany. The privacy policy lists the other providers we use.
  • All connections are encrypted via HTTPS, with HSTS.
  • Database and queue can't be reached from the internet. The only public ports are web (80 and 443) and SSH server access, which works with keys only.
  • Operating-system security updates are installed automatically. Repeated failed login attempts on the server are blocked automatically.
  • Our web server shortens IP addresses before writing them to its access logs.
  • We regularly review the server with our own security check: open ports, firewall, access, backups, certificates.

Accounts and access

  • We store passwords only as a hash (scrypt), never in plain text.
  • Signup is protected against bots with Cloudflare Turnstile. Login and signup attempts are rate-limited.
  • Every agency sees only its own data. We verify this with an automated test that deliberately tries to access another agency's data.
  • Team roles: admins manage billing and the team, operators manage sites and notifications, members see everything and run checks.
  • Expired login sessions are deleted automatically.

Backups

We back up the database every night and copy the backups daily to a second system outside the server.

If something happens

If a security incident affects your agency's data, we inform you without undue delay so you can meet your own obligations.

Found a vulnerability?

Email us at security@trackneat.com.

Please give us time to fix the issue before you publish it. Don't access other people's data and don't disrupt the service. If you follow these rules, we thank you and won't take action against you.

Machine-readable contact details are at trackneat.com/.well-known/security.txt.