Data Security & Compliance at Elly Analytics
At Elly Analytics, we prioritize the security, integrity, and privacy of client data across all touchpoints. Our infrastructure and internal practices are designed to meet the standards expected by financial institutions, healthcare organizations, and enterprise clients.Our security program is documented in our Information Security Policy, owned by our Chief Information Security Officer and approved by the CEO, and is aligned with the SOC 2 Trust Services Criteria.
We operate with transparency and precision across all stages of the data lifecycle — from collection and storage to access and deletion.
Privacy-First Data Collection, Storage & Transmission
We collect data strictly with client permission and only for the purposes of delivering analytics and optimization services.
By default, we:
Avoid collecting personally identifiable information (PII)
Use hashed or anonymized user IDs where possible
Do not collect sensitive device identifiers such as IP or MAC addresses
Where web analytics platforms are involved, cookies may be used depending on the platform’s configuration and the consent framework implemented by the client.
We support two standard data configurations:
1. Anonymized Data Setup (Default)
We work primarily with anonymized identifiers — such as Google Client IDs or CRM user IDs — and avoid the use of names, emails, or phone numbers unless explicitly required.
2. Personal Data Setup (Optional)
When specific reporting needs require identifiable information (e.g., user-level breakdowns), we can work with names or contacts. In these cases:
Personal data is classified as Confidential under our Information Security Policy and is encrypted in transit (TLS 1.2+) and at rest
Personal data is stored only in the client's dedicated database within our approved production environment — never on personal devices or in non-production environments
Access is restricted to authorized personnel on a least-privilege basis, authenticated with MFA, logged, and reviewed at least annually
Types of Data We Process
Depending on the project, we may work with two broad data categories:
A) Behavioral / Attribution Data
Clickstream events (from Google Analytics, Meta Ads, etc.)
Campaign tags and UTM parameters
Funnel progressions and goal completions
B) Transactional / CRM Data
Lead form completions and statuses
Customer segmentation
Purchase amounts or custom client tags
Each client's data is kept in a dedicated database and is logically segregated from other clients by network boundaries that permit connections only through documented, controlled interfaces. Client data is never shared across accounts.
Secure Storage Architecture
Server database; supporting platform services (PostgreSQL and Blob Storage) operate under the same controls
Data is hosted on Microsoft Azure and on dedicated servers at Leaseweb, in environments operated exclusively by Elly Analytics
Client data is stored only in the approved production systems recorded in our asset inventory
Data at rest is stored in an encrypted manner using industry-standard encryption provided by the database engine and the cloud platform; backups are encrypted as well
Access Management
Access limited to authorized personnel: the assigned project team and the engineers who operate the platform (systems administrators, DevOps and SRE), each with the minimum access their role requires
Enforced via unique accounts and multi-factor authentication (MFA) for personnel access to production and infrastructure systems; any exception is approved and recorded
Access is granted and revoked through a ticketed approval process; access of departing personnel is revoked within 24 hours, and all access is reviewed at least annually
Role-based permissions restrict exports, connectors, and dashboards
PowerBI Row-Level Security can be applied on request
Network is protected by network security groups, private endpoints and firewall rules that deny access by default and allow only documented flows, to prevent unauthorized access and mitigate external threats.
Data Deletion on Request
We offer complete data removal upon request or on termination of the contract:
Deletion of the client's data, access tokens and credentials from all production systems within 14 days of a verified request or contract termination
Backup copies are immutable and cannot be selectively deleted; they expire automatically at the end ofthe backup retention period (up to 90 days)
Removal of PowerBI files and export pipelines
Formal confirmation upon completion
Data Recovery
Client data is retained for the term of the customer agreement and deleted thereafter (see Data Deletion)
Daily encrypted backups are maintained separately for recovery scenarios: full backups run at least daily (with transaction-log backups every 15 minutes for SQL Server), are stored geo-redundantly outside the failure domain of the protected system, are protected against modification or deletion, and are retained for up to 90 days
Recovery objectives: RPO 24 hours, RTO 48 hours. Restoration from backup is tested at least annually
Data Usage and Client Control
All data usage at Elly Analytics is governed by transparency, purpose limitation, and client control. We use data solely:
To deliver agreed-upon analytics services
To develop or improve our services, only where permitted by the customer agreement; production client data is not used in development or test environments unless approved in advance and protected with production-equivalent controls
To generate optional aggregated benchmarks (de-identified, where permitted by the customer agreement)
AI features process client data through our AI model gateway (OpenRouter) and models hosted in our own Microsoft Azure and Google Cloud accounts. AI providers do not use client data to train their models.
We do not:
Sell client data
Share data with ad exchanges or data brokers
Enrich third-party datasets
Clients retain full control over what is collected, stored, and reported — and we will never use or disclose data beyond the scope explicitly authorized.
All data transmitted across a network boundary — public endpoints, connections between our sites, and connections from our applications to databases and other data stores — is encrypted with TLS 1.2 or higher.
Security Program
In addition to the controls above, our Information Security Policy requires:
• Vulnerability management: container images and dependencies are scanned on every build; servers and Kubernetes nodes are assessed continuously; independent third-party penetration tests are performed at least annually. Critical findings are remediated or mitigated within 14 days, High within 30 days
• Monitoring and logging: authentication, administrative and data-store access events are logged centrally, reviewed daily, and retained for at least 90 days
• Incident management: a dedicated Incident Response Team led by the CISO investigates, contains and documents security incidents, and notifies affected clients and authorities where required
• Change management: every production change is documented, tested and approved by a reviewer other than its author before deployment; emergency changes are reviewed and approved within five business days
• People: all employees and contractors sign confidentiality agreements, pass reference checks, and complete security awareness training within 30 days of hire and annually thereafter
• Vendors: critical and high-risk vendors (including our hosting providers Microsoft Azure and Leaseweb, and our AI model gateway, OpenRouter) are reviewed at least annually against their SOC 2 / ISO 27001 reports
HIPAA & Industry Compliance
Elly Analytics is committed to protecting the privacy and security of protected health information (PHI) in accordance with the HIPAA Privacy and Security Rules wherever a client engages us to process PHI under a Business Associate Agreement.
Our compliance framework includes:
Appointed security and compliance officer (CISO) and regular employee training
Technical safeguards (encryption, least-privilege access with MFA, logging and monitoring) for systems storing or processing PHI; physical safeguards are provided by our hosting providers, Microsoft Azure and Leaseweb, and verified through their compliance reports
Business Associate Agreements (BAAs) with relevant third parties
Incident detection and breach notification protocols
HIPAA Compliance Statement
Summary
We embed security and privacy into every level of our platform and services. Our clients can trust that their data — whether anonymized or structured — is handled with care, transparency, and compliance.
Questions? Contact us at
security@ellyanalytics.com
This page reflects Elly Analytics' current data handling practices and is based on our internal policies and compliance documentation. For custom security requirements or documentation requests, please contact us directly.