Security & compliance
Fidero processes your customers’ data on your behalf. This page sets out how that responsibility is handled: the design decisions that limit what’s collected, where data lives and how it’s protected, the GDPR terms it’s processed under and what’s certified today. The contractual backing for all of it is the data processing agreement.
What Fidero collects – and doesn’t
Section titled “What Fidero collects – and doesn’t”Several of Fidero’s security properties are design decisions rather than controls:
- Fidero’s identifiers are first-party and random – IDs, not personal data – and there are no third-party cookies. The profile Fidero builds lives server-side, where the controls below apply
- The SDK captures the browser context you’d expect (page, campaign parameters, referrer) and the events you send it. It doesn’t fingerprint and it doesn’t scrape
- Personal data that strays into a URL is scrubbed before delivery. When a
query-string value on a page or referrer URL matches a pattern Fidero
recognises (an email address, today), Fidero replaces the value with
[redacted]before the event reaches your warehouse or any destination, and leaves the rest of the URL exactly as sent - Identifiers that ad platforms match on, like email and phone, leave Fidero hashed to each destination’s specification
Scrubbing is pattern-based, and the pattern set grows platform-wide with nothing to change on your side. It has a boundary: personal data Fidero can’t recognise – an opaque ID only your systems can map to a person, or personal data in a URL path or fragment – is yours to keep out of the URLs you send.
Consent is enforced before anything reaches a third-party destination – Consent & privacy covers the model. These decisions follow from the server-first architecture, which the platform overview explains.
Where your data lives
Section titled “Where your data lives”Fidero runs in the EU. Two subprocessors host the service:
| Subprocessor | What it does | Data location |
|---|---|---|
| DigitalOcean | API hosting and data storage | EU |
| Amazon Web Services | CDN and configuration storage | EU |
Where a plan includes US data residency, the deployment is provisioned on request in the same providers’ US regions, and the subprocessor table above is updated in advance.
Where an international transfer applies, it happens under the UK or EU Standard Contractual Clauses, and changes to the subprocessor list are notified in advance. Both terms are in the DPA.
Retention follows the agreement rather than a fixed period. Fidero’s enrichment is stateful – it depends on persistent identity and attribution state – so personal data is retained for as long as it’s needed to provide the service, which in practice means the duration of the agreement. A fixed deletion window would cut short the multi-year customer journeys that state exists to preserve. You control retention throughout: you can instruct deletion at any time.
On termination you have 30 days to request your data back. It’s returned in a documented, machine-readable format, and Fidero’s copies are destroyed – on your instruction, or automatically once the window closes and any return is complete.
GDPR and the right to erasure
Section titled “GDPR and the right to erasure”Under GDPR you’re the controller and Drivn Ltd (the company behind Fidero) is the processor. The data processing agreement governs that relationship, including support with data subject requests, assistance with data protection impact assessments and prior consultations, and notification within 72 hours if a breach is discovered.
Erasure works end to end. When you forward a deletion request, Fidero removes the
person’s profile and sends the deletion on to your connected destinations, so the
removal doesn’t stop at Fidero’s own records. On the browser side,
reset() clears the identifiers Fidero set.
Operational security
Section titled “Operational security”The day-to-day controls are stated as commitments in the DPA’s technical and organisational measures. In brief:
- Personal data is encrypted in transit and at rest – industry-standard transport-layer encryption between your systems, Fidero and your destinations, and full-volume encryption in storage, with keys managed and rotated by the hosting infrastructure
- Personal data is backed up automatically – backups are encrypted, stored separately from the primary infrastructure and can be restored after an incident
- Access to personal data is need-to-know. Activity logs record what was accessed and changed
- Development, test and production environments are separated, and production personal data doesn’t enter test or development without anonymisation
- Staff with data access are under confidentiality obligations and receive ongoing security training, and offboarding removes access
- An information security policy is documented, management-approved and communicated to staff
Certifications
Section titled “Certifications”Fidero holds no SOC 2 or ISO 27001 certification today. The commitments that stand behind the service are contractual instead: the DPA’s technical and organisational measures, Standard Contractual Clauses where transfers need them, and 72-hour breach notification. They’re also verifiable: the DPA gives you the right to information that demonstrates compliance, including responses to your security questionnaire. Where that isn’t enough or a regulator requires it, you have the right to audit, including inspections.
If your security review needs more than this page, ask. We answer these questions directly.