Security and data
Collect less. Protect all of it.
Mockly is built to answer questions about your site without collecting more than it needs. Here's what it records, what it never stores, and how it keeps your sites and your visitors safe.
Visitor data
What Mockly records, and what it doesn't.
Page views are counted by the server that sends the page, not by a tag in the browser. That's enough for analytics and experiment results, and it leaves out what you don't need.
| Recorded | Never stored |
|---|---|
| The page served, and when | IP addresses |
| A device class, browser, and OS family | The raw user agent |
| The referring site's host and UTM tags | Full referring URLs |
| Goals reached, and the variant each visitor saw | Third-party trackers or ad tags |
| Load timings and scroll depth | Visits from bots and crawlers |
| On pages with a heatmap: where clicks land on the page's elements | What visitors type, or recordings of their visits |
How we protect sites
Safe by default, not by configuration.
Strict pages.
Published pages are sent with a strict Content-Security-Policy and nosniff. All escaping goes through one module, and every URL attribute is checked, on the server and in the browser.
Only safe files.
Sites can host images, fonts, and PDFs, never HTML or scripts. Uploads must match their format's signature, and SVG is served sandboxed.
Signed webhooks.
Form submissions forwarded to a webhook are signed with HMAC-SHA256 and a timestamp, so your receiver can verify them and refuse replays.
Secrets are encrypted, and never shown again.
API keys for your CMS are encrypted before they're stored, sent only to the addresses you set for each, and never written into a page. Code that tries to send one anywhere else is stopped before it's sent. No one can read a value back, owners included, and every change is recorded.
Spam and abuse limits.
Forms drop bot submissions quietly and limit how often one client can submit.
First-party cookies only.
Each visitor's id and experiment variants live in first-party cookies on your site, so a visitor sees the same variant every time.
Early access
More to come.
Mockly is in early access. Before it leaves early access, we'll publish our full privacy policy, the services we use to run Mockly, and how we handle data requests. Until then, the privacy page says what Mockly collects today.
Found a security issue, or have a question about data? We'd like to hear about it.
Contact us about securityRun your first experiment this week. Build it, test it, ship the winner.
Free to start. No credit card required.