Security and privacy

Not in full, by default. PubTrust truncates every IP address at the edge before it is stored: IPv4 to /24, IPv6 to /48. The truncation happens in the Cloudflare Worker that receives the beacon, which means the full address is never written to our database, never leaves the edge, and is never available to our own staff. What we keep alongside it is country, region, city, ASN and network operator — which is what the data is actually for, because malvertising campaigns are regional and network-correlated and truncation does not degrade that analysis at all. Full-IP retention exists for organisations that have a documented need, but it is opt-in per organisation, requires an explicit written acknowledgement in the interface, and carries a 30-day hard cap that cannot be extended.

Two kinds of beacon and nothing else. A violation beacon fires within about two seconds of a catch and carries the forensic record: the matched rule and pack, the layer, the severity, the advertiser domain, the landing URL, the creative ID, the bidder, the slot ID, the page URL, the referrer, coarse geography and network, browser and OS family, device class, and the truncated IP. A summary beacon fires once per pageview on pagehide carrying exact counts — impressions, violations and blocks by policy — plus full detail on roughly 2% of clean impressions for creative-mix analysis. Both are sent with navigator.sendBeacon as text/plain, which keeps them CORS-simple requests with no preflight, and both are compact positional arrays rather than verbose JSON.

Deliberately asymmetric, because violations and clean impressions have very different value. Violations: 90 days in full raw detail. Clean impressions: 30 days, and only a ~2% detail sample is retained raw at all — though 100% are counted in the aggregates, so your numbers are complete even though the rows are not. Aggregated rollups are kept indefinitely for year-over-year trend and for billing. Expiry is enforced by dropping whole daily table partitions rather than by a delete job that might quietly fall behind, which means the deletion is structural and verifiable rather than best-effort.

Six, and they are engineering constraints in the codebase rather than promises in a contract. Every hook and callback is wrapped in try/catch, so the tag can fail but the page cannot. A self-disabling watchdog unhooks everything and goes dormant the moment the tag throws past a threshold or exceeds its CPU budget, and reports why. A remote kill switch, carried on the tag’s configuration poll, lets us disable a misbehaving build globally or for one site within about five minutes, with no deploy from you. window.__ptDisable = true is your own permanent escape hatch. Every monkey-patch is reversible and preserves both original behaviour and Function.prototype.toString fidelity, so we do not trip another vendor's integrity checks. And the tag loads async with nothing synchronous on your critical path.

Yes, including the things vendors usually keep to themselves. Every action — yours, your team's, an API client's, an agent's or ours — is written to an append-only audit log that is trigger-enforced and SHA-256 hash-chained, so a tampered entry is detectable rather than merely unlikely. Staff impersonation is visible to you in your own audit trail. It requires a typed reason, is time-limited, is read-only by default and needs a second explicit confirmation to gain write access, and shows the staff member a permanent banner throughout. Both the acting user and the impersonator are written into every affected row. There is no silent impersonation in this product, and there is no configuration that enables it.

Read and draft, never enforce. The MCP surface allows metrics, trends, violations, drill-downs, sites, policies, packs and report generation on the read side, and policy authoring on the write side — creating and editing policies, adding keywords, domains and URL patterns, proposing pack terms, creating fallback creatives. Switching a policy from Monitor to Block creates a pending approval that a human clicks in the dashboard; the agent can recommend enforcement and cannot perform it. Billing is entirely outside the agent's scope. Every agent action is audit-logged with the agent's identity recorded separately from the human's, so "the agent did it" is a statement you can verify rather than an excuse.

Beacons are received by Cloudflare Workers at the global edge, where they are validated against the site's origin, enriched with coarse geography and network data, truncated, and batched into a queue. Batches are signed with HMAC and delivered over HTTPS to our application platform, where they are written to Postgres. Your readers' browsers never talk to our origin — only to Cloudflare's edge — which is both a latency property and a security one. Sub-processors are listed publicly and we notify before adding one. Data residency options beyond the default are available on the Scale plan; ask, and we will tell you honestly what we can and cannot do rather than tick a box.

Email security@pubtrust.cc. We will acknowledge within one business day and give you a substantive response, not a holding message, within five. We do not require an NDA to accept a report, we will not threaten you, and we will credit you publicly unless you ask us not to. If you find a way to make our tag break a page, that is a security report as far as we are concerned and we would like to hear about it with the same urgency as anything else.