Cabin collects as little as possible, and most of our security story falls out of that: data we never collect is data that can never leak.
Everything below is what we do today. There is nothing on this page we haven't built yet.
Cabin sets no cookies and stores no device identifiers. There is no cross-site profile of your visitors, because there is nothing to build one from.
A visitor's IP address is never written to disk. It's held in memory in Ireland just long enough to look up a country, then discarded. It never reaches your dashboard, and it can't appear in a backup or a breach, because it was never stored.
What we keep for your account is small: your email address, your domains, and your settings.
All traffic to Cabin runs over TLS. Everything we store is encrypted at rest with AES-256.
Account data and analytics data are stored and processed in AWS's Ireland (EU) region.
The one exception is support: our help desk runs in the United States, so anything you email us lives there. See section 10.
So the tracking script stays fast for visitors anywhere in the world, small collection endpoints run in a handful of other AWS regions. They receive a request and pass it to Ireland. Nothing is written to disk on them. Our privacy policy lists the current regions.
Passwords are hashed with bcrypt. We never store them in plain text and we can't read them. If you'd rather not have a password at all, you can sign in with Google or GitHub instead.
Sign-in, sign-up and password reset are protected by Cloudflare Turnstile, which blocks automated attempts without making you click on traffic lights.
Access to the AWS account that holds your data is kept to the minimum, and every account that has it requires multi-factor authentication, root included. There are no shared logins.
Cabin is served over HTTPS only, and we send HSTS, so your browser refuses to fall back to plain HTTP. Session and dashboard cookies are HttpOnly, Secure and SameSite, so a script can't read them and they never travel unencrypted. The session cookie itself is encrypted and signed, so its contents can't be read or altered outside our servers.
API keys and dashboard tokens are scoped to your account and can be revoked from your settings at any time. Revoking is immediate and retroactive: it invalidates tokens already issued, not just future ones.
Stripe handles all payments. Card numbers never touch Cabin's servers. We store a Stripe customer reference and nothing else.
The account database has continuous point-in-time recovery enabled, so we can roll back to any moment in the recent past after an accident or a bad deploy.
You can delete a site's data, or your entire account, from your settings. It's immediate and irreversible. See section 6 of our terms.
Email hello@withcabin.com with what you found and how to reproduce it, and we'll reply. Please don't run tests that degrade the service for other people, and don't access data that isn't yours.
We don't pay a bounty, but we'll credit you if you'd like us to. Our security.txt has the same details in machine-readable form.
Cabin is an independent service, and we're not SOC 2 certified. If your procurement process needs a security review, a DPA, or answers to a questionnaire, email us and we'll work through it with you.
Questions about anything here? Email us at hello@withcabin.com.