Skip to content
GROWTH DEPT.MTA

Security

Attribution without shopper identities.

MTA links visits to orders without keeping anyone's contact details. Each store's data is walled off from every other store's, and connections to your platforms only ever read.

  • Your site, your data

    The pixel runs on your own domains and sends events straight to MTA. It sets no third-party cookies and loads no other scripts.

  • No shopper details

    No emails, names, phone numbers, addresses or IP addresses in any table or log. Customer ids are hashed with your store's own key.

  • Every store walled off

    The database itself keeps each store's rows apart from every other store's, under a role that cannot switch that off.

Where it runs

One database, one store per request.

The app runs on Vercel in the US East region and the database on Neon Postgres in AWS us-east-1. Platform secrets live in Vercel's encrypted settings, not on any Growth Dept machine.

  • Access by role

    Owners, admins, members and viewers for each account. Google sign-in and two-factor sign-in are available, and five failed sign-ins in 15 minutes lock that address for 15 minutes.

  • Tokens encrypted at rest

    Platform tokens are encrypted with AES-256-GCM before they are stored, and are only ever sent back to the platform that issued them.

  • Kept only as long as needed

    Raw events and identity links are deleted after 13 months; daily aggregates stay. Thirty days after a brand is deleted, MTA starts deleting all of its data for good.

The details

How each part is handled.

What the pixel collects

  • Page views and shopping events (product viewed, added to cart, checkout started and completed) with the page address, the referring site's host, click ids and UTM tags.
  • A visitor id kept in your own domain's cookie and local storage, or Shopify's own client id on Shopify pages.
  • Only parameters on an allow list are kept. The browser's user agent is read to filter bots and is not stored.
  • No IP address, email, name, phone number, street address or device fingerprint.

What is stored about orders

  • The money fields attribution needs: totals, tax, shipping, discounts, refunds and line items.
  • The customer id only as an HMAC hash under a key that belongs to your brand, so the same shopper cannot be matched across brands.
  • Contact fields sent to the orders API are dropped without being stored. An email address is the one exception: it is kept only as a hash under your brand's key, to match ad views a measurement partner sends to the order.

How brands are kept apart

  • Every table that holds brand data carries the brand's id, and Postgres row-level security limits each request to one brand.
  • The application connects as a database role that cannot bypass row-level security.
  • API keys belong to one brand, and a key presented with another brand's id is simply not found. Tests check this on every change.
  • Identity links stay inside one brand: no cross-brand matching, IP matching or fingerprinting.

Access to your platforms

  • MTA only reads from the platforms it connects to: orders and line items from Shopify, campaign structure and daily spend from the ad platforms. Meta is connected with the ads_read permission.
  • For brands Growth Dept already runs, MTA reads through Growth Dept's existing connection with a read-only key. Requests that would change anything are refused.
  • Platform tokens are encrypted with AES-256-GCM before they are stored and are only sent back to the platform that issued them.

Accounts and staff access

  • Roles per organization: owner, admin, member and viewer. Invites are single-use links that expire after seven days.
  • Sessions use HttpOnly cookies, forms are protected against cross-site requests, and five failed sign-ins in 15 minutes lock that email address for 15 minutes.
  • API keys are shown once and stored only as a hash.
  • Growth Dept staff can open a brand read-only to help with support. Each such visit, and every change to accounts, brands, access and keys, is written to an audit log.

Retention and deletion

  • Raw events and identity links are deleted after 13 months. Daily aggregates are kept.
  • Shopify's shop erasure request, which Shopify sends 48 hours after the app is uninstalled, deletes the store's orders, visits and attribution, and the files on its Documents page. Its customer erasure request removes the customer's hash and identity records and re-keys their visits with random ids; their orders stay, credited to Unattributed.
  • When a brand is deleted, its API keys stop working at once. Thirty days later, MTA starts permanently deleting everything it holds for the brand. The deletion runs in batches, so it finishes shortly after that day rather than on it. Exports the brand already downloaded stay with it.

Where it runs

  • The application runs on Vercel in the US East region (Washington, D.C.), and the database on Neon Postgres in AWS us-east-1.
  • Platform secrets live in Vercel's encrypted environment settings, not on any Growth Dept machine.

Send security questions and reports to support@growthdept.ai.