Security in plain words

What protects your site and your data: a wall around your data, a code for every live change, locked Google access, and no personal data in events.

Needlr can change your live website, so it's built to keep that power in your hands. Here is what protects your site and your data. The short official list is on the security page.

Think of a bank's safe-deposit boxes

At a bank, every customer has their own box behind a thick wall. To open yours, the bank checks it's really you. Only a few staff hold the master keys, and they keep them in a safe.

Needlr works the same way. Your data sits behind its own wall. Big changes need a code only you have. And the keys to your Google account are locked away.

Your data never mixes with other customers'

• Every customer's data is walled off in the database itself, not only in the app.
• Automatic tests try to reach other customers' data on every code change, and check that nothing leaks.

A code for every change to your live site

These actions need a code from your authenticator app:

• Connecting Tag Manager.
• Publishing, and rolling back.
• Starting or stopping an impact check that changes your site.
• Shipping a winner.

One code covers the next 20 minutes. After that, Needlr asks again. Needlr's own staff tools need a code too (more).

Your Google access is locked away

• Your Tag Manager and Google Analytics access is stored encrypted.
• Only one internal service holds the key. It can't be reached from the internet.
• No screen and no API ever shows your Google token.

Privacy

• Events carry no personal data: a random visitor id, the page and the KPI. No names, no emails, no IP addresses.
• Needlr follows your cookie banner through Google Consent Mode. When a visitor says no, nothing is stored or sent, and they aren't in any test (more).
• Raw events are deleted after 90 days. Daily counts without visitor ids are kept 13 months, so older releases can still be measured.

Coding agents can measure, not publish

• An agent connects with its own key, only for the projects you choose. Needlr stores only a fingerprint of the key, never the key itself.
• Agents create impact checks, read verdicts and record decisions. They can't publish to Tag Manager, change your site, or read anything about a single visitor.
• You can pause or disconnect an agent at once (more).
• What people and agents do in your account is written down, with who did it and when. Open Activity in the menu on the left to see it.

Where it runs

• Servers and the database are in Germany, at Hetzner. Web traffic reaches them only through Cloudflare.
• Backups run every night, encrypted. The key that opens them is not on the server.

Checked by attack, not only by reading

In October 2026 Needlr was reviewed in two layers. First an automated review of the code, the add-ons it uses and the server. Then an attack test with two real accounts trying to reach each other's data. No customer's data could be read or changed from another account. The problems found in the code were fixed.

Common mistakes

• Sharing one login. Invite each person instead (how). Then every change is made, and written down in Activity, under their own name.
• Putting a secret in a check. See the warning above.
• Giving a new agent every project. Start with one project, see what it does, then add more.