GDPR Compliance

A technical breakdown for engineers implementing CertiLayer, of how the SDK's behavioral-only feature extraction helps you stay GDPR and CCPA compliant. For the legal document, see the GDPR page; this guide is the implementation-level companion.

No raw input leaves the device

Keystrokes, cursor coordinates, and touch paths are reduced to timing/movement statistics client-side. Only the 34-number vector is transmitted.

No fingerprint, no persistent ID

CertiLayer's session IDs are randomly generated per-session and not correlated with any user identity by CertiLayer itself.

Retention is fixed at 90 days

Session analytics data (session_events) expires automatically via TTL after 90 days, regardless of plan tier. Raw feature vectors used for model improvement (training_samples) are retained indefinitely, with no identity attached beyond the session ID.

You're the Controller for your users

CertiLayer acts as Data Processor for behavioral data collected via your integration. See /dpa for the processing terms.

⚠️

If you choose to pass additional identifying data into optional SDK fields (e.g. tagging a session with a user ID for your own correlation), that data is your responsibility as Controller — CertiLayer's zero-PII design applies to the behavioral signal itself, not to anything extra you attach.

ℹ️

Need a signed Data Processing Addendum for procurement? See /dpa — available on Starter plans and above.