Data Loss Prevention Strategy

This page describes how Metrifact reduces the risk and impact of personal data loss or exposure. It's written to reflect what the system actually does, not a generic template.

1. Data minimization is the primary control

Metrifact does not maintain a separate copy of the personal data it reads from connected platforms (Shopify orders/customers, Google Ads/ Meta Ads audience data, GA4/Search Console reporting data). Each request fetches data live from the source platform and returns it directly to answer that request — there is no bulk data warehouse or historical archive to lose. The only thing stored long-term is the OAuth credential needed to make that live request on your behalf, plus basic connection metadata (account IDs, display names).

2. What is stored, and how it's protected

• OAuth tokens and connection metadata are stored on encrypted infrastructure (Supabase/Postgres, encryption at rest and in transit provided by the platform).
• The database is only ever accessed via a service-role credential held in the server's own environment variables — never distributed, never committed to source control, never logged. Application logs are deliberately capped to prevent secrets from being written to request logs.
• Any error message that could contain a token or key is redacted before being written to the activity log (see Section 3).
• API keys are stored as a one-way hash only — the plaintext key is never retained after the moment it's first shown to you.

3. Detection

Every tool call made through Metrifact is recorded (which tool, which user, success/failure, a scrubbed error message if it failed) — this activity log is the basis for spotting unusual access patterns. See our Security Incident Response Policy for how this feeds into an actual response.

4. Access control

There is no separate "staff" tier with broader access than the account owner — the service-role credential that can read the underlying database is restricted to the deployed server process itself, not held by any individual outside of it. Every user-facing feature is scoped per-tenant: one user's connections, tokens, and data are structurally isolated from every other user's, by the same mechanism that powers multi-tenancy (see our Privacy Policy).

5. Rate limiting as a loss-prevention control

Every platform connector paces its own API calls to that platform's published rate limits. Beyond protecting your connected accounts from being flagged, this also bounds how much data could ever be pulled through a single compromised session in a given window — there is no bulk-export capability that could move a large volume of data in one request.

6. Encrypted backups

Database backups are provided and encrypted by our infrastructure provider (Supabase) as a platform default, consistent with the encryption already described in Section 2.

7. Immediate revocation

Disconnecting a platform account deletes its stored credential immediately, not just marks it inactive — there's no lingering copy of a revoked token anywhere in the system after that point.

8. Where personal data actually goes

Data retrieved through Metrifact is returned to the AI assistant you've connected (e.g. Claude, ChatGPT), at your own direction, to answer the question you asked. What that assistant provider does with it afterward is governed by their own policies, not this one — see our Privacy Policy.

9. Contact us

Questions about this policy: security@metrifact.com