Security / trust page — Umami

Cited by

Facts read from this source

• SOC 2 status Report an error

  “SOC 2 Not currently certified”

• ISO 27001 status Report an error

  “ISO 27001 Not currently certified”

• Pentest status Report an error

  “Independent penetration test Not yet completed”

• DPA availability Report an error

  “Data Processing Agreement Publicly available”

• GDPR CCPA posture Report an error

  “GDPR and CCPA Umami is designed to support compliant analytics use”

• Custom assessments Report an error

  “Custom vendor assessments can be considered under Enterprise agreements.”

• Privacy defaults Report an error

  “Does not use cookies Does not track visitors across different websites Does not collect names, email addresses, or other directly identifying information Does not use analytics data for advertising Does not sell customer or visitor data”

• Optional features Report an error

  “These include Distinct IDs, custom event or session properties, revenue tracking, session replays, and heatmaps.”

• Session replay default Report an error

  “Session replays are disabled by default and require an additional recorder script. Input fields are masked by default, stricter masking can be enabled, and customers can exclude sensitive areas from recording.”

• Encryption transit Report an error

  “Connections to Umami Cloud are encrypted using HTTPS and industry-standard TLS.”

• Encryption rest Report an error

  “Customer data is stored using infrastructure and database providers that support encryption at rest.”

• Stripe payments Report an error

  “Payments for Umami Cloud are processed by Stripe. Umami does not directly store complete payment-card numbers or card security codes.”

• Data isolation Report an error

  “Umami Cloud logically separates customer accounts, teams, websites, and analytics data.”

• MFA internal Report an error

  “Multi-factor authentication on critical services where supported”

• Open source Report an error

  “Umami is open source under the MIT license. Our source code is publicly available for customers, researchers, and the community to inspect.”

• Data regions Report an error

  “Geographic data-region selection for Umami Cloud accounts”

• Breach notification Report an error

  “When a confirmed incident affects customer data, we will notify affected customers without unreasonable delay and in accordance with applicable law and contractual requirements.”

• Backup residual copies Report an error

  “Residual copies may remain in backups under ordinary retention and backup cycles; see DPA Section 8.3, Backups and legal retention.”

• Vulnerability disclosure Report an error

  “To report a vulnerability, contact security@umami.is.”

• Bug bounty Report an error

  “Umami does not currently operate a guaranteed paid bug-bounty program.”

• Self hosted control Report an error

  “The self-hosted edition gives organizations complete control over where Umami runs and where its data is stored.”

• Scope limitation Report an error

  “The practices on this page apply primarily to Umami Cloud. Customers who self-host Umami control and are responsible for the security of their own infrastructure and deployment.”

• No certification claims Report an error

  “We describe our practices accurately and do not claim certifications or independent assessments that we have not completed.”

Scores citing this record

• The Agency Developer Consent-free operation & data minimisation
• The Agency Developer Data access, export & self-hosting
• The Agency Developer European sovereignty
• The Data Protection Officer Consent-free operation & data minimisation
• The Data Protection Officer Data access, export & self-hosting
• The Data Protection Officer European sovereignty
• The E-Commerce Marketing Lead Consent-free operation & data minimisation
• The E-Commerce Marketing Lead Data access, export & self-hosting
• The E-Commerce Marketing Lead European sovereignty
• The Growth Analyst Consent-free operation & data minimisation
• The Growth Analyst Data access, export & self-hosting
• The Growth Analyst Installation, integrations & performance
• The Growth Analyst European sovereignty
• The Public-Sector Site Owner Consent-free operation & data minimisation
• The Public-Sector Site Owner Data access, export & self-hosting
• The Public-Sector Site Owner Installation, integrations & performance
• The Public-Sector Site Owner European sovereignty
• The Skeptic Consent-free operation & data minimisation
• The Skeptic Data access, export & self-hosting
• The Skeptic European sovereignty