Cookieless Analytics & Data Minimization
ISMS Copilot measures usage with cookieless Vercel Web Analytics (aggregate page views) and monitors errors with Sentry, configured not to collect personal data automatically.
英文内容
ISMS Copilot keeps analytics to what is needed to run and improve the service: cookieless web analytics that count aggregate page views, and error monitoring that does not collect personally identifiable information automatically. Conversation content and uploaded documents are never shared with analytics providers.
What We Use
| Service | Purpose | What it receives |
|---|---|---|
| Vercel Web Analytics | Aggregate page views | Page views, recorded without cookies |
| Sentry | Error monitoring for the web app and backend | Technical error reports; in production, your user ID (UUID); no email addresses, names or conversation content |
How Cookieless Analytics Works
Vercel Web Analytics records aggregate page views without cookies:
- No analytics cookies: no tracking cookies are set in your browser for analytics
- Aggregate counts: we see how many page views a page receives
- No advertising or marketing cookies: we do not use them
Page views only: web analytics count page views in aggregate. ISMS Copilot sends no custom analytics events.
Error Monitoring Without Default PII
Sentry helps us find and fix technical errors. It is configured to minimize personal data:
sendDefaultPii: false: the Sentry SDK does not automatically collect personally identifiable information- Scrubbing before sending: authorization headers, cookies, tokens, API keys and other sensitive fields are stripped from error events before they leave the app
- Pseudonymous user ID only: in production, error reports carry your user ID (UUID) so we can troubleshoot faster; no email addresses or names are sent
- No session replay: we do not record your screen or keystrokes
- Location and retention: error data is processed in Germany and error logs are kept for 90 days
Data Minimization Principles
Cookieless analytics directly supports GDPR's data minimization principle (Article 5(1)(c)), which requires that personal data be:
- Adequate: Sufficient for understanding which pages are used and which errors occur
- Relevant: Page views and technical errors, not personal browsing habits
- Limited: No analytics cookies, only a pseudonymous user ID (UUID) in error reports, no conversation content
We collect only what's needed to measure aggregate platform usage and keep the service healthy, without analytics cookies.
What We Collect
- Aggregate page views (cookieless, via Vercel Web Analytics)
- Error events with technical context such as browser and device information (via Sentry)
- In production, your user ID (UUID) attached to error reports
What We Don't Collect
- Analytics, advertising or marketing cookies
- Conversation content or uploaded documents (never shared with analytics)
- Email addresses or names in error reports
- Credentials and tokens (stripped from error events before they are sent)
- Screen recordings or keystroke logging (no session replay)
We measure aggregate page views, not detailed user journeys. We've chosen privacy over detailed tracking.
Analytics at a Glance
| Feature | ISMS Copilot (Cookieless) |
|---|---|
| Tracking cookies | ✅ No cookies |
| Custom event tracking | ✅ Not used, page views only |
| Automatic PII in error reports | ✅ Off (sendDefaultPii: false), pseudonymous UUID only |
| Session replay | ✅ Not used |
Why This Matters
Cookieless analytics reflects our broader commitment to:
- Privacy by design: Building data protection into our technical architecture, not as an afterthought
- Transparency: Openly documenting exactly what we collect and how
- Data minimization: Collecting only what's necessary to run and improve the product
- User privacy: Keeping analytics to aggregate page views, with no analytics cookies
If you have questions about our analytics practices, contact support through the Help Center.
Related Resources
- Privacy Policy - Complete data processing documentation
- Data Privacy & GDPR Compliance - Your privacy rights explained
- Security & Data Protection Overview - Infrastructure and security measures
- Register of Processing Activities (ROPA) - Detailed processing records