generated: '2026-08-13'
method: searched
source: https://umami.is/security
url: https://umami.is/security
provider: Umami
providerId: umami
description: >-
  Umami publishes a detailed security page covering privacy-by-design,
  encryption, access control, secure development, infrastructure, incident
  response, data retention/deletion and responsible disclosure. It also
  publishes an unusually honest assurance table that states plainly what it has
  NOT certified.
correction: >-
  The automated probe (probe-security-programs.py) matched the strings "SOC 2"
  and "ISO 27001" on this page and recorded them as certifications. That was
  keyword matching, not reading: the page names both only to say "Not currently
  certified". This file was corrected by hand on 2026-08-13. Umami holds no
  third-party security certification and has not completed an independent
  penetration test.
certifications: []
certifications_explicitly_denied:
  - name: SOC 2
    status: Not currently certified
  - name: ISO 27001
    status: Not currently certified
  - name: Independent penetration test
    status: Not yet completed
compliance:
  - name: GDPR
    status: claimed
    detail: >-
      "Umami is designed to support compliant analytics use." Umami does not use
      cookies, does not collect directly identifying information, and does not
      track visitors across sites, so it states no cookie consent banner is
      required.
  - name: CCPA
    status: claimed
    detail: Same posture as GDPR; stated on both the security and pricing pages.
  - name: Data Processing Agreement
    status: published
    url: https://umami.is/dpa
    detail: Publicly available without a sales conversation.
  - name: PCI
    status: delegated
    detail: >-
      Payments are processed by Stripe. Umami states it does not directly store
      complete payment-card numbers or card security codes.
  - name: Open-source review
    status: published
    detail: >-
      Source code publicly available under MIT at
      https://github.com/umami-software/umami — offered on the security page as
      a substitute form of independent review.
data_residency:
  available: true
  regions: [us, eu]
  detail: >-
    Geographic data-region selection for Umami Cloud accounts. The API honors it
    as a path segment — https://api.umami.is/v1/us and https://api.umami.is/v1/eu
    — defaulting to the region of the account that owns the key.
practices_published:
  encryption_in_transit: HTTPS with industry-standard TLS.
  encryption_at_rest: >-
    Delegated to infrastructure and database providers that support encryption
    at rest; backups protected by the applicable provider's controls.
  secrets: Production credentials stored separately from source; access restricted.
  tenancy: >-
    Logical separation of customer accounts, teams, websites and analytics data,
    enforced by application authorization controls.
  access_control:
    - Individual accounts rather than shared production credentials
    - Least-privilege permissions
    - Multi-factor authentication on critical services where supported
    - Restricted administrative and production access
    - Access removal when no longer required
  sdlc:
    - Peer review of material code changes
    - Automated testing
    - Dependency and vulnerability monitoring
    - Regular dependency and security updates
    - Separation of development and production environments
    - Investigation of reported vulnerabilities and GitHub security advisories
  incident_response: >-
    Documented process. Umami commits to notifying affected customers without
    unreasonable delay when a confirmed incident affects customer data, by
    email, in-app, or via the service-status page.
  availability: >-
    No uptime guarantee outside the Enterprise plan, which lists an Uptime SLA.
    Status published at https://umami.statuspage.io.
customer_security_review: >-
    "Security questionnaires and additional information may be provided during a
    legitimate customer procurement or security review." Contact via
    https://umami.is/contact.
stated_direction: >-
  "We are evaluating formal compliance programs and an independent third-party
  penetration test as Umami Cloud and its enterprise customer base grow."
contacts:
  security: security@umami.is
  privacy: privacy@umami.is
  support: support@umami.is
  sales: sales@umami.is
related:
  - https://umami.is/privacy
  - https://umami.is/dpa
  - https://umami.statuspage.io
evidence:
  - url: https://umami.is/security
    status: 200
    note: >-
      Body is streamed as a Next.js RSC flight payload; read from the payload
      rather than the initial HTML shell, which contains only the page title.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com