Security
We use multiple cloud providers to help us deliver our service.
The following is an overview of the security of various services we use to power Fathom:
Service providers
The following is a list of the key service providers we rely on to power Fathom Analytics.
bunny.net (CDN)
Analytics collection is routed via our EU-based CDN, bunny.net, to achieve data isolation. The CDN is distributed worldwide, and your website visitors will hit the data center closest to them.
We use SSL / TLS to ensure connections between your website visitors and our CDN are encrypted.
Amazon Web Services (AWS)
Amazon Web Services is utilized to process website traffic for traffic outside of the EU.
As you might imagine, Amazon Web Services has incredible levels of security:
Fathom Analytics employs the following security measures to protect our AWS infrastructure:
- Access keys are regularly audited and, where appropriate, deleted
- Only management has direct access to our AWS account
Databases
We use two separate databases: PlanetScale for application data and ClickHouse Cloud for analytics. We restrict access to both and practice data minimization, storing only the information needed to provide the service.
PlanetScale — application data
PlanetScale hosts the application database that supports our accounts and the day-to-day running of Fathom. PlanetScale publishes SOC 2 Type II reports and encrypts database data at rest and in transit, including its database backups. You can read more in PlanetScale’s security documentation and request its audit reports through the PlanetScale Trust Center.
ClickHouse Cloud — analytics data
ClickHouse Cloud hosts our analytics database. Its service undergoes independent SOC 2 Type II audits, and ClickHouse holds ISO 27001 certification for its information security management system. Its security and compliance documentation explains the audit coverage, with reports available through the ClickHouse Trust Center.
Our data journey explains how a website visit becomes analytics in your dashboard.
Additional security measures
We take the following steps to ensure the highest level of protection for the service:
- We heavily restrict access to our infrastructure and personal data. Employees and contractors do not have access to information such as your address, as we treat this with extreme confidentiality. Our support staff would have access to your email & full name only when required for support requests.
- Confidentiality obligations bind all employees, contractors, and agents
- App security: All access to Fathom Analytics is secured over SSL (HTTPS), ensuring the information is encrypted. We utilize managed services to ensure we have the best engineers in the world working on our infrastructure, and we hire the best engineers possible when we have to build infrastructure ourselves (e.g. EU Isolation)
- Our servers are all highly available, meaning that, in the event of a failure, there is an active-standby (often in another availability zone)
- We utilize SQS as our queue system, which is a highly available queue system, to ensure we don’t lose essential jobs
- 256-bit SSL encryption within our application and for payment processing.
- We one-way hash your Fathom password, meaning we can’t convert it back to a plain text original
- We run multiple firewalls to protect from DDoS & spam attacks
- We utilize external monitoring to ensure we are notified in the rare event of a service issue. Outside of that, we have managed service providers who have huge teams of engineers managing our infrastructure for us.
If you have any questions about security at Fathom Analytics, please reach out, and we’d be happy to answer your questions.