Security at Metriclune
Your clients trust you with their accounts. Here is exactly how we look after them.
Read-only access to your platforms
You connect accounts by signing in on Google, Meta or TikTok's own pages. Metriclune never sees your passwords. We request reporting permissions only:
| Platform | Permissions requested |
|---|---|
| Google Analytics 4 | analytics.readonly |
| Google Search Console | webmasters.readonly |
| YouTube | yt-analytics.readonly, youtube.readonly |
| Google Ads | adwords. Google offers no read-only Ads scope; Metriclune only runs reporting queries and contains no code that changes campaigns. |
| Facebook and Instagram | pages_show_list, pages_read_engagement, read_insights, instagram_basic, instagram_manage_insights |
| TikTok | user.info.basic, user.info.stats, video.list |
Encryption
- All traffic uses HTTPS with HSTS. Insecure requests are redirected.
- Platform access tokens are encrypted at rest (Fernet: AES with HMAC authentication) before they reach the database.
- Passwords are hashed with PBKDF2. Invitation links and website outcome API keys are stored only as one-way hashes. Password reset and email confirmation links are signed and expire.
Isolated workspaces
Every request checks that you belong to the workspace you are reading. Staff accounts get no shortcut across workspaces. Roles limit what each person can do: owners manage access and billing, editors manage sources and reports, viewers read and download.
Account protection
- Session cookies are Secure, HttpOnly and SameSite, with CSRF protection on every change.
- Optional two-step sign-in with any authenticator app (Google Authenticator, 1Password and similar), with one-time recovery codes. Each code works once, and wrong codes are limited per account.
- Sign-in, password reset and signup attempts are rate limited.
- Changing your password signs out your other sessions. Changing your sign-in email needs your password, a click from the new inbox, and tells the old one.
- Optional bot protection on signup with Cloudflare Turnstile.
Payments
Payments are handled by Stripe, a PCI DSS Level 1 certified provider. Card details are entered on Stripe's own pages and never touch Metriclune's servers.
Your data, your call
- Deleting a source deletes its stored metrics and any saved reports containing it.
- Deleting your account deletes the workspaces where you are the only owner. See data deletion.
- Export any source as CSV and any report as PDF, CSV or JSON at any time.
Report a vulnerability
Found a security issue? Email support@metriclune.com with the details. Please give us a reasonable chance to fix it before sharing it publicly. We don't take legal action against good-faith research.
See your whole picture in ten minutes.
Start a free 14-day trial. No credit card needed.