Technical security
Technical security in Haimoo Analytics
This page describes technical boundaries verified from current code and a dated observation. It is not a certification, availability guarantee or comprehensive operational promise.
Collection and storage
Request data is processed for bounded functions, and raw IP addresses are not stored in analytics events.
The collection endpoint processes the request IP transiently for rate limiting, coarse location, bot detection and visitor estimation. It processes the full User-Agent string to derive coarse browser, operating-system and device-type categories.
Application boundaries
Code places boundaries on collection and webhook requests.
Current code includes origin validation, input and request-size limits, rate-limiting boundaries, webhook timeouts and minimum secret-length checks. These are named application controls, not a promise of complete protection.
Operational boundary
A dated observation is not a future guarantee.
On 26 August 2026, the observed production service used HTTPS, HSTS and the documented security headers. The production application and primary PostgreSQL analytics store were observed in Hetzner's Helsinki location.
This page makes no promise about comprehensive backup encryption or a fixed copy-retention count, uninterrupted availability, certification, infrastructure access limited to named people or a fixed incident-notification time.