Security at TAGGRS
How we protect the tracking data that passes through TAGGRS: certification, encryption, access control, data location and monitoring. Each section links to its evidence, so you can share it with colleagues reviewing TAGGRS.
- ISO 27001 certified
On this page
Security at a glance
Certification
ISO 27001 certified information security management
Encryption
Your data is encrypted in transit and at rest
Data location
Server-side GTM hosting on European infrastructure
Access control
User roles, and single sign-on (SSO) on Enterprise plans
Monitoring
Firewalls and continuous monitoring
Consent
Google Consent Mode v2 support
ISO 27001 certification
What the certification means
ISO 27001 is the international standard for information security management. It requires documented controls for how data is protected, who can access it and how risks are handled, audited by an independent certification body. For you, that means your tracking data is handled under audited, verified security controls.
Data protection
Control over what leaves your server
Every event reaches your server container before it is sent to any platform. There you can remove fields, hash identifiers such as email addresses, and send each platform only the fields it needs.
Consent
The server container can check the consent state before forwarding data and only send it for the purposes a visitor agreed to. Google Consent Mode v2 is supported.
Consent Mode v2 guideWhat this does and doesn't cover
TAGGRS supports your compliance with GDPR and other privacy laws, but no tool makes a tracking setup compliant on its own. Server-side Tracking does not remove the need for consent. It gives you control over what data is shared and where it is processed.
Is Server-side Tracking GDPR-compliant?Encryption
Your data is encrypted in transit and at rest.
Access control
Single sign-on
Teams can sign in to TAGGRS through single sign-on (SSO), so access is managed centrally by your identity provider and removed when someone leaves. SSO is available on Enterprise plans.
User roles
TAGGRS has different user roles on both the organization and the product level, so each team member only gets the access their work needs.
Where your data is processed
Tracking data runs through European hosting providers and is kept for 30 days. Our subprocessors are listed publicly, and the infrastructure is monitored continuously.
- European hosting providers
- 30-day retention
- Product specific processing agreements
Server-side GTM hosting
Server-side tracking data is processed only by our European hosting providers, and kept for 30 days.
European provider
Our hosting provider, UpCloud, is a European company headquartered in Finland. Your tracking data is hosted with a European provider in the EU, not with a US cloud provider. This gives you more control over who can access your data and under which laws.
Subprocessors
The third parties that process data for us, such as our hosting providers, are listed in the processing agreement for each product.
Subprocessor listProtection and monitoring
The infrastructure is protected by firewalls and monitored continuously. Current server status is published on the status page.
Server status page
Documents
The documents a procurement or privacy review usually asks for, all public on our legal pages.
Questions and answers
Is TAGGRS ISO 27001 certified?
Yes. TAGGRS is ISO 27001 certified, and the certification is audited by an independent certification body.
Where is my data processed?
Server-side GTM hosting runs on European hosting providers, so data is processed in the EU.
Is data encrypted?
Yes. Your data is encrypted in transit and at rest.
Does TAGGRS support single sign-on?
Yes. Single sign-on (SSO) is available on Enterprise plans, so your team signs in with your identity provider.
Does Server-side Tracking make us GDPR compliant?
No tool makes a setup compliant on its own, and Server-side Tracking does not remove the need for consent. It gives you control over which data is shared, with whom, and where it is processed, which makes compliance easier to achieve and document.
Can I get a data processing agreement?
Yes. The processing agreement is part of the product terms for each product. They are public on our legal pages, with the list of subprocessors.
Can't find what you need?
Send us your question with the requirement you're checking, and we'll confirm we've received it.