Compliance#

Where TryFast stores your data, how long it keeps it, how it is secured, and how you get it out again, with answers to the compliance questions buyers ask most.

Last updated: 2026-10-25

This page describes the security and compliance posture of TryFast, operated by subprocess.eu/company, Osloer Str. 83, 13359 Berlin, Germany. It separates the controls in place today from items on the roadmap. For a questionnaire-style view, see the ISMS FAQ.

Server Location#

Hosted in Germany. TryFast runs entirely on infrastructure of Hetzner Online GmbH in Germany: the website, the app, the API, the MCP server for AI agents, the script host cdn.tryfast.eu, event collection and both databases run on our production server in Hetzner's data center in Nuremberg, and all backups and raw event logs are stored in Hetzner Object Storage in Germany. Our sign-in service login0 and our inbound mail forwarder run on the same Hetzner infrastructure.

There is no other region to choose or misconfigure. Visitor data and project data are stored and processed only in Germany. Two providers outside Hetzner handle personal data for us, and neither receives visitor data or project data from our systems: Amazon Simple Email Service in the AWS region eu-central-1 (Frankfurt) delivers the account and invitation emails of our sign-in service, and Google Workspace hosts the support mailbox that receives the email you send to our tryfast.eu addresses (see Subprocessors for locations and safeguards).

Subprocessors#

Four: Hetzner Online GmbH (servers in Nuremberg and object storage in Germany), the subprocess mail forwarder (operated by us, inbound email only), Google Cloud EMEA Limited (Google Workspace, our support mailbox, email only) and Amazon Web Services EMEA SARL through our sign-in service login0 (account and invitation emails). Details, data categories and the 30-day change notice are on the Subprocessors page.

AI agents you connect to TryFast and the tools you feed from your website's dataLayer are your choice and your own processing; they are not our subprocessors.

Data Retention#

Short, fixed retention for visitor data. Numbers are maximums; deleting an experiment, project or workspace removes its data sooner.

Data	Kept
Raw event logs (for recovery and reprocessing)	30 days
Per-visitor experiment data (which variation a visitor saw, their conversions)	while the experiment runs, then 90 days after it stops; afterwards only totals and the final results remain
Daily visit data per visitor (for traffic counts and conversion baselines)	35 days
Hashed order ids (to count each order once)	90 days
Monthly tested-visitor list (for plan usage)	the current month, and the previous month until the 3rd
Recent events view in the app and for agents	24 hours, in memory only
Totals without visitor data (daily traffic, goal totals, usage)	400 days
Experiment results	until you delete the experiment, project or workspace
Activity log	2 years
Sign-in sessions	30 days
Account data (name, email, memberships)	until you delete your TryFast account
Invitations	14 days, then deleted
Unsaved workspaces (created without an account)	paused after 30 days without use, deleted after 90 days without use; deleted after 24 hours if never used
Backups	application database: deleted data leaves within 2 days; event database copies and raw logs: within 35 days

IP addresses are not stored anywhere, not even in web server logs. Visitor ids are random; the event database stores them only as hashes computed per project, and raw event logs keep them for 30 days. Full details for your privacy notice are in Privacy and consent.

Information Security#

Encryption in transit: every TryFast endpoint is TLS-only, with HSTS on tryfast.eu. Backups travel to object storage over TLS.
Secrets stored as hashes: API keys, OAuth tokens, recovery tokens, invitation tokens and browser grant cookies are stored only as SHA-256 hashes; session cookies are HMAC-signed. Disk-level encryption of server volumes and backups is not claimed today; client-side encryption of backups is on the roadmap.
Tenant isolation: every read is filtered by the caller's workspaces inside the database query, and objects of other workspaces answer "not found". An automated test matrix covers every route.
Least privilege in your team: roles (owner, admin, member, viewer), API keys and AI agent connections with three permission levels that never exceed the creator's current role, and approval links so that agents cannot launch, change traffic or stop experiments without a person, unless you grant full access. Pausing is always allowed.
Sign-in: through login0, our shared sign-in service, which requires every user to set up two-factor authentication or a passkey at first sign-in.
Your website stays safe: the script that runs on your pages contains only our code, uses no eval, and wraps each piece of your custom code so that an error aborts that experiment for the page view and never breaks your page. Custom code is checked when you save it, and HTML changes may not contain scripts or javascript: links. Scripts are served from cdn.tryfast.eu, a separate host that never reads or sets cookies.
Abuse controls: workspaces created without an account cannot put custom JavaScript live until they are saved to an account, and we can switch off any project immediately (its script then does nothing).
Administration: server access only for the named operator with SSH keys; operator actions only on a loopback-only interface with a separate admin token.

Backups and Disaster Recovery#

The application database (accounts, workspaces, projects, experiments, results) is replicated continuously to Hetzner Object Storage in Germany, separate from the server.
The event database is copied every 6 hours and uploaded, keeping 7 days of copies plus 4 weekly copies. Raw event logs are uploaded every hour and kept for 30 days, so the event database can be rebuilt from them.
A restore drill is documented: restore both databases on a fresh server, start the service and compare totals and the latest results of running experiments.
TryFast fails safe for your website. If our servers cannot be reached, the script does not load, visitors see your original pages, and the page is never hidden longer than the anti-flicker timeout (800 ms by default). Events that cannot be delivered are kept in the visitor's browser and sent again for up to 24 hours.
TryFast runs on a single server without a hot standby. We do not yet commit to a formal recovery time objective; a second location is on the roadmap.

Logging and Monitoring#

The web server writes no access logs. IP addresses are used only in memory, for rate limits.
Application logs record errors and background jobs; they never contain IP addresses, tokens, cookies, Authorization headers or visitor ids.
We count requests and page views per hostname anonymously: before a request is counted, its IP address, headers, cookies and query string are removed.
Service health and business counters are collected from a metrics endpoint reachable only on the server itself, and every deployment ends with automated health checks.
Inside TryFast, every change to your workspace is written to the activity log with the person, API key or AI agent that made it.

Vulnerability Management#

TryFast is a single program with a small set of open-source dependencies pinned to exact versions with checksums. We follow security advisories for the Go toolchain and each dependency and update promptly.
Operating system security updates are applied on a regular cadence, with expedited handling of critical vulnerabilities in exposed services.
Every change runs static checks and the full automated test suite, including the security tests listed under Penetration Testing.

Incident Response and Breach Notification#

Security reports reach the operator directly at security@tryfast.eu (see the Vulnerability Disclosure Policy).
Incidents are triaged, contained (for example by switching off a project, revoking credentials or rotating secrets), fixed and documented in a written post-incident note.
If a personal data breach affects your data, we notify your workspace owners and admins without undue delay and at the latest within 72 hours of becoming aware, as committed in the Data Processing Agreement.

Personnel and Confidentiality#

TryFast is operated by one named person at subprocess.eu/company, Liam van der Viven, who is bound to confidentiality. No other employee or contractor has access to customer data. Any future team member signs confidentiality obligations and completes security onboarding before receiving production access, limited to what their role needs.

Funding and Stewardship#

TryFast is bootstrapped and operated by subprocess.eu/company, a self-funded company in Berlin. There is no venture funding and no pressure to monetize data: revenue comes only from subscriptions, and visitor data is never sold or used for advertising. If TryFast were ever discontinued, customers would receive at least 90 days notice and could export all their data (see Migration and Data Export).

ESG: Carbon Footprint#

TryFast runs in Hetzner data centers in Germany; Hetzner states that its data centers are powered by electricity from renewable sources.
All customers share one efficient server instead of dedicated infrastructure per customer.
The script your visitors load is under 12 KB compressed, and engine plus experiments arrive in one request, so every page view transfers fewer bytes than with larger testing scripts.
We have not yet measured a carbon footprint figure for TryFast.

Vulnerability Disclosure Policy#

Please see the Vulnerability Disclosure Policy. Machine-readable contact information is published at /.well-known/security.txt.

Penetration Testing#

No external penetration test has been performed yet. Security testing is part of development and runs automatically on every change: a tenancy isolation matrix (no route returns another workspace's data), CSRF and origin checks, refusal of private and internal addresses by our outbound fetcher, rejection of custom JavaScript that tries to escape its function, OAuth redirect matching, PKCE and refresh-token reuse detection, a check that stored request replays never contain secrets, and a schema test proving that no database column stores an IP address. A first external penetration test is planned after the launch phase; its summary will be linked here. Researchers may test within the rules of our Vulnerability Disclosure Policy.

Certifications#

We do not currently hold ISO/IEC 27001 certification or a SOC 2 report. Certification is on the roadmap as the company grows. Our hosting provider, Hetzner Online GmbH, operates ISO/IEC 27001 certified data centers, including the Nuremberg data center that runs TryFast.

Migration and Data Export#

There is no lock-in, and you can take your data out at any time:

Definitions: every project, goal, audience and experiment (with variations, changes, CSS and JavaScript, targeting and statistics settings) is available as JSON through the documented REST API, described in OpenAPI at https://tryfast.eu/api/openapi.yaml. An experiment read from the API can be created again from the same JSON once the read-only fields are removed.
Results: each experiment's results as CSV, and as JSON with daily numbers.
Activity log: as JSON through the API.
One-file export: a single download of a whole workspace is planned; until then the API covers everything.

Leaving TryFast means removing one script tag from your pages. Nothing else on your site depends on TryFast; variations you shipped to all visitors stop when the tag is removed, so build them into your site first.

Account Deletion#

Your TryFast account: delete it yourself in the app under Account, or with DELETE /api/v1/me. Workspaces where you are the only member are deleted with it, your API keys and agent connections stop working, and your activity entries remain labelled "deleted user". If you are the only owner of a workspace with other members, make someone else owner first.
Your sign-in identity: login0 is shared by our products, so it is deleted separately in the login0 account console.
A workspace: owners delete it in the workspace settings. Its scripts do nothing from that moment on, its data is deleted immediately from the application database and within minutes from the event database.
One visitor: erase a single visitor's data with the visitor erasure API, applied within a minute.
Workspaces without an account are paused after 30 days without use and deleted after 90 days without use.

Backups and the activity log age out as described under Data Retention.

Security questionnaires#

We publish a normalized ISMS questionnaire at /legal/isms-faq.md.

Due to capacity constraints, we ask that you use our normalized ISMS questionnaire instead of sending your own. To map your questionnaire to our answers, give an AI assistant your questionnaire together with this prompt: "I need to fill out my company's ISMS security questionnaire, which is attached. We will be using the TryFast service. Answers to most questions are published at https://tryfast.eu/legal/isms-faq.md and https://tryfast.eu/legal/compliance.md. Please fill out my questionnaire from that information. The documentation at https://tryfast.eu/docs/ can help with questions those pages do not answer. List any question that cannot be answered so I can follow up. Try to complete the full questionnaire."

Frequently asked questions#

TryFast is built so you can run A/B tests in line with the GDPR: we process your visitors' data only on your behalf under the Data Processing Agreement that is part of our terms on every plan, everything is hosted in Germany, IP addresses are not stored, visitor ids are random and live at most 390 days, and the script waits for consent by default. Whether your use is compliant also depends on your choices: the consent mode of each project and how you describe TryFast in your privacy notice. Privacy and consent has text you can use.

In Germany and most EU countries, yes: A/B testing is not covered by the exemptions for strictly necessary cookies. By default TryFast waits for your banner and stores nothing before consent; one line connects Cookiebot, Usercentrics, OneTrust, Didomi or any IAB TCF banner. France's CNIL accepts A/B testing without consent under strict conditions, which our exempt mode supports; it is not a general "no banner" switch. See Privacy and consent.

Does TryFast store IP addresses?#

No. IP addresses reach our servers with every request and are used only in memory, for rate limits. They are not written to any database, log or backup, and an automated test checks that no database column can hold one.

Is any data transferred outside the EU?#

Visitor data and project data stay in Germany: TryFast stores and processes them only on Hetzner infrastructure in Nuremberg and in Hetzner Object Storage in Germany. Emails you send us are the exception: our support mailbox is hosted by Google Workspace, which Google states may store and process data in the EU and the US, under the EU Standard Contractual Clauses in Google's Cloud Data Processing Addendum. Please include no more visitor data in an email than your request needs; for an access request, that is the visitor id. Account and invitation emails are delivered by Amazon Simple Email Service in eu-central-1 (Frankfurt) under AWS's Data Processing Addendum with the EU Standard Contractual Clauses. If you connect an AI agent, the data your agent reads goes to the AI provider you chose, under your agreement with them.

Do you sign a data processing agreement?#

Yes. The Data Processing Agreement under Art. 28 GDPR is part of our terms on every plan, including Free, and applies automatically. Email legal@tryfast.eu for a countersigned copy. Enterprise customers can agree custom terms.

Who is the controller and who is the processor?#

For your website's visitors, you are the controller and TryFast is your processor. For your team's accounts and for visitors of tryfast.eu, we are the controller; the Privacy Policy covers both roles.

How do we answer a visitor's request to delete their data?#

Use the visitor erasure API with the visitor's id: their assignments, conversions and visit rows are deleted within a minute. For access requests, email support@tryfast.eu with the visitor id and we help you within the deadlines of Art. 12 GDPR. Visitors can also stop all tracking themselves with the opt-out link described in Privacy and consent.

Can AI agents see our visitors' personal data?#

Agents see the same as your team in the app: aggregated results and the recent events of your projects with random, pseudonymous visitor ids, never IP addresses. Keep names and email addresses out of event properties, URLs and order ids so they never reach TryFast or an agent.

What happens to our website if TryFast is unavailable?#

Nothing breaks. The script does not load, visitors see your original pages, and the page is hidden at most for the anti-flicker timeout (800 ms by default). Experiment changes resume as soon as the script loads again.

Is TryFast ISO 27001 or SOC 2 certified?#

Not yet. Our hosting provider's data centers are ISO/IEC 27001 certified, and our controls are documented on this page and in the ISMS FAQ.

What happens to our data when we cancel or delete our account?#

Cancelling a paid plan moves the workspace back to the free plan and keeps its data. Deleting a workspace removes its data immediately from the application database and within minutes from the event database; backups age out within 35 days. Export what you need first (see Migration and Data Export).

View as markdown