Security

This page only describes what we have checked in our code or on our infrastructure, with the date of the check. ConsentLift holds no security certification (neither SOC 2 nor ISO 27001) to date.

IP address

The service that receives consent events (a Cloudflare Worker) does not read the visitor's IP address. It receives the country and region already computed by Cloudflare, and that is all it keeps of the location. Our event tables have no IP address column. An automated test, run on every build, checks which headers the Worker reads. Our server logs, which contain the IP address and user agent of whoever downloads the script, are described in the privacy policy (§2 and §5).

User agent

The browser's user agent is read in memory, only to recognise bots, and is not stored. The recorded event only keeps the browser family, the operating system and the device type.

Non-persistent identifiers

• The page-load identifier is drawn at random on every page load and does not survive navigation.
• The script writes two values to the visitor's device, in the tab's sessionStorage, erased when the tab closes: cl_sid, a random session identifier, and cl_buffer, events whose sending failed. No cookie. A check run on every build fails if a third value appears.

Configuration database backups

The database holding organisations, domains, accounts and alerts is backed up every day at 03:00 UTC, off the server, to Cloudflare R2, with 30-day retention. A full restore was exercised on October 5, 2026: 17 tables out of 17 restored, in 7.5 seconds end to end. The backup is daily, with no point-in-time recovery: a restore can lose up to 24 hours of configuration changes. Consent events are not in this database: they are stored at Tinybird (§4 of the privacy policy).

Hosting

The API, the website, the script and the configuration database run on a single server rented from Hetzner Online GmbH, located in Nuremberg (Germany), checked on October 13, 2026.

Providers and processing locations

Other providers, what they process and where, are listed in §4 of the privacy policy.

Contact

For a security question or a questionnaire: hello@consentlift.com.