Sign in

Data privacy

Keep your product
intelligence private.

Self-host Countly on your own infrastructure, or run it in a dedicated environment operated by Countly. With self-hosting, your product data stays within the infrastructure you operate. Masking at ingestion and consent enforced in the SDK: privacy is a property of the architecture, not a document.

Explore our Trust Center ↗
ISO 27001Certified
ISO 27017Certified
ISO 27018Certified
SOC 2Type II examined
TISAX®Participant*
GDPRData protection
HIPAAHealth data

*Countly Ltd. is a TISAX® Participant. TISAX® is a registered trademark of and governed by ENX Association. Learn more at enx.com/tisax

Explore our Trust Center ↗

Capabilities

Every requirement of a
regulated team, built in

Financial services, healthcare, automotive and the public sector run Countly because the architecture already answers the questions their security review asks.

Dedicated environments

Dedicated environments only. Flex gives you a single-tenant instance; Enterprise runs on your own infrastructure: your cloud, your data center or air-gapped.

No default access

On Enterprise, Countly has no access to your data without your explicit permission. On Flex, Countly operates the environment; operational access is limited, granted by you and recorded in the audit log.

Masking at ingestion

PII is masked, hashed or dropped before storage. Field-level rules per app and platform.

Consent, enforced

Consent categories are enforced in the SDK and recorded server-side. Opt-outs generate no data, not filtered data.

Data subject requests

Export or purge a single user across all events and profiles from one place, with an audit record.

Compliance posture

Countly is ISO 27001, ISO 27017 and ISO 27018 certified, SOC 2 Type II examined and a TISAX® participant. Its controls support GDPR and HIPAA requirements on both editions.

AI inside your boundary

Cee’s product agents can run fully inside your infrastructure when configured. The Documentation Agent, the Countly AI Gateway (EU) and third-party AI providers run outside.

Flex vs Enterprise

Same platform,
two ways to run it

Same platform, same data model. The difference is where it runs and who operates it.

Compare plans and pricing
AspectFlexEnterprise
EnvironmentDedicated single-tenant instanceYour cloud, your data center or air-gapped
Data residencyThe Google Cloud region you chooseWherever you deploy, including air-gapped networks
Vendor accessOperated by Countly; access limited, granted by you and loggedNo default access
EncryptionTLS in transit, encrypted at restTLS in transit, at rest, your own keys
Masking and consentAt ingestion, per featureAt ingestion, per feature
Data subject requestsExport and purge per userExport and purge per user
Audit and accessRoles, SSO / SAML, audit logsRoles, SSO / SAML, audit logs, your controls
EvidenceSOC 2 Type II report, DPAYour own audit scope, DPA

In depth

How it works,
in detail

The parts that matter when you evaluate this area seriously: what it does, how it behaves at the edges, and what your team controls.

Deployment

Run it where the data is allowed to be

Choose the Google Cloud region on Flex, or self-host Countly on your own infrastructure with Enterprise: your cloud, your data center or a fully air-gapped network with no outbound connection. The platform is the same.

  • Your choice of Google Cloud region on Flex
  • Your cloud, your data center or air-gapped on Enterprise
  • Same features, same data model, same SDKs

Access

Who saw what, and why

Roles and per-app permissions, SSO and SAML, and an audit log of every access to user-level data. Security teams get the evidence, product teams get the access they need.

  • Role-based access per app and feature
  • SSO / SAML with your identity provider
  • Audit log of user-level data access

Requests

Data subject requests in one place

A GDPR access or deletion request is a lookup by user identifier followed by an export or a purge across events, profiles and engagement history. Countly does this from one screen and records the action in the audit log, so the DPO has evidence without engineering involvement.

  • Export a user’s complete data set as a file
  • Purge a user across all events, profiles and campaigns
  • Audit record of every request and who executed it
  • Retention rules purge on schedule without requests

FAQ

Questions
teams ask us

Straight answers on how this part of Countly works in practice. For anything else, talk to us.

How does Countly support GDPR?

Yes. Consent is enforced in the SDK, data can be exported or purged per user, residency is your choice and a DPA is part of every contract. Compliance obligations that depend on your setup are documented for both editions.

Can Countly run fully offline?

Yes. Enterprise supports air-gapped deployments with no outbound connection. Updates are delivered as packages you install yourself.

What can Countly staff see on Flex?

No access by default. Operational access happens only when you grant it, for running the service, and it is logged. Nobody at Countly uses your data for anything else, and nothing is pooled with other customers.

Does Countly have access to our data?

On Enterprise, no. Self-host Countly on your own infrastructure and your product data stays within the infrastructure you operate; Countly has no access without your explicit permission. On Flex, Countly operates the environment for you. Operational access is limited, granted by you and recorded in the audit log.

Which security and compliance standards does Countly support?

Countly is ISO 27001, ISO 27017 and ISO 27018 certified, SOC 2 Type II examined and a TISAX® participant. Its deployment, access control, consent and data management capabilities support GDPR and HIPAA requirements. Reports and documentation are available in the Trust Center and on our Security page.

Is Countly a TISAX® participant?

Yes. Countly Ltd. is a TISAX® participant, the assessment used across the automotive industry. TISAX® is a registered trademark of and governed by ENX Association. Note that TISAX® is a participation, not a certification.

Do you support HIPAA workloads?

Yes. Healthcare customers run Countly on Enterprise, which includes a BAA, inside their own controlled environment.

AWSBMW GroupVerizonSchneider ElectricCoca-ColaStandard CharteredSAPAllianzElsevierRaiffeisen BankTelekom

Data privacy

Your data. Your region.
Your infrastructure.

Talk to securityExplore our Trust Center ↗