Security, in plain words.

Needlr can change your live site, so it's built to keep that power in your hands. Here is what protects your site and your data.

Your data never mixes with other customers'

  • Every table is walled off per customer by row-level security in the database itself, not only in the app.
  • Tests call every admin route as another customer and check nothing leaks. They run on every code change.

A code for every change to your live site

  • Connecting Tag Manager, publishing, rolling back, starting or stopping a check that changes your site, and shipping a winner all need a code from your authenticator app.
  • One code covers 20 minutes. After that, Needlr asks again. Our own admin tools need a code too.

Google access, locked away

  • Your Tag Manager and Google Analytics access is stored encrypted (AES-256-GCM).
  • Only one internal service holds the key. It can't be reached from the internet, and no screen or API ever shows the token.

Privacy

  • No personal data in events: a random visitor id, the page and the KPI. No names, no emails, no IP addresses.
  • Needlr respects your consent banner through Google Consent Mode. When a visitor says no, nothing is stored or sent, and they aren't in any test.
  • Raw events are deleted after 90 days. Daily counts without visitor ids are kept 13 months, so releases can be measured further back.

Coding agents can measure, not publish

  • An agent connects with its own key, for the projects you choose. Only a fingerprint of the key is stored; you can pause or disconnect it at once.
  • Agents create checks, read verdicts and record decisions. They can't publish to Tag Manager, change your site or read anything about a single visitor.
  • You choose whether an agent's split tests start on their own. Everything an agent does is in the audit log under its name.

Where it runs

  • Servers and the database are in Germany, at Hetzner. Web traffic reaches them only through Cloudflare.
  • Backups run every night, encrypted. The key that opens them is not on the server.

Reviewed by attack, not only by reading

  • In October 2026 we reviewed Needlr in two layers: an automated review of the code, dependencies and server, then an attack-minded test with two real accounts trying to reach each other's data.
  • No customer's data could be read or changed from another account. The findings in the code were fixed, and the key checks now run on every code change.

Good to know

What a check shows on your site is public by design: anyone can read the Tag Manager file a site loads. Don't put anything secret in a check.

A security question, or found a problem? Write to [email protected]. How the verdicts are computed is in the methodology.