Only what's needed
A lightweight script collects standard usage signals. By default, it doesn't collect what visitors enter in forms.
How we handle your data
Built to protect what your
website and its visitors
share with us
A clear look at how Siteimprove.ai collects, secures, and governs data across the platform, and the controls you have over it.
The path your data takes
Four steps, from a visitor's browser
to your dashboard
Encrypted in transit
We encrypt data in transit. When your site uses HTTPS, the script sends data to us over HTTPS.
Stored on secure infrastructure
We host your data on cloud infrastructure in the EU or the US. Your hosting location is assigned when your account is created, based on where your organization is located, and you can request a different one.
Your data stays yours
We process the data we collect on your behalf on your instructions, and we only share it with the sub-processors that help us deliver the service, as listed in our DPA.
Data Collection What we collect and what we don't
We built our platform to collect only what's needed to power your insights. Our website crawler loads publicly accessible pages and captures the on-page content needed for analysis.
By default, it doesn't collect end-user inputs or credentials. When our tracking script runs on a page, it gathers standard details such as the page visited, the page title, browser and device information, and where the visitor came from, so you can understand how your site gets used.
Some additional signals, like search terms typed on your site, custom event tracking, or scroll and click behavior, are optional. We only turn them on when you ask us to.
We don't collect or store what visitors enter in forms on your site. If you turn on Session Replay, you decide which fields are masked and blocked.
Infrastructure Where your data lives, and how it's protected
We host data on secure cloud infrastructure in either the EU or the US. Your hosting location is assigned based on where your organization is located.
We encrypt customer data in transit and at rest. Access to the systems that store it follows least-privilege and need-to-know principles, uses multifactor authentication where technically feasible, is logged, and is covered by employee confidentiality obligations.
A note on external scanners
Some tools that scan websites flag a "US data transfer" mainly because of where a script's domain is registered, not where the data actually flows. We deliver our script through a content delivery network, which is separate from where we process and store your data.
Privacy Controls Controls that put you in charge
Beyond our default protections, our analytics capabilities give you configurable options to further limit what we collect and store:
IP anonymization
Turn this on and we mask stored IP addresses. The change takes effect after a 72-hour delay, so you can reverse it during that window. After that, we no longer hold the raw address and can't recreate it. You can still see a visitor's general location.
Cookieless tracking
Turn this on and we replace cookies with a Visitor Hash built from hashed technical details, such as browser type and language and a hashed IP address. Cookieless tracking also applies instant, irreversible IP anonymization. It's designed so that individual visitors can't be identified, and it's a good fit if you want visitor analytics without setting cookies.
Traffic exclusion
Turn this on and we stop recording traffic from the IP ranges you choose, like internal employee traffic. This works alongside your anonymization settings.