From every visitor to aggregate reports, with nothing left to leak.
A request becomes a memory-only token, the token becomes a sketch, the sketch becomes a report, and the key that made the token is destroyed on a fixed clock. What remains was never personal data. Here is each step and what it does not do.
Different data, different lifetimes.
Aggregate outputs, security signals and wrapped recovery material each have their own rules and their own clock. The design is enforced by executable checks; the live evidence pack shows each destruction as it happens.
- 01
Permission and edge collection
One tag, three lanes. Consenting visitors enter the consent-accepted lane. Visitors who never answered and have not objected enter the anonymous statistics lane under the controller's attestation. Everyone is measured for security. The SDK never interrogates device capabilities.
- 02
Enrichment
Allowed request fields are normalised into coarse reporting dimensions such as country, device family and configured page group. Available dimensions depend on the deployed contract and property policy, not every field in the original product design.
- 03
Security scoring
Security signals use a separate processing lane, keys and retention limit. Only a bot label and confidence score may cross into an otherwise permitted operational request. Raw security data is not reused to create visitor statistics.
- 04
Token derivation
The ingest service derives an HMAC over permitted request context using a per-tenant, per-window salt. Plaintext salts and deduplication tokens are restricted to process memory; wrapped recovery material has a separately controlled lifetime.
- 05
Sketch update
The token updates a HyperLogLog sketch keyed by tenant, date, country, page group, device family and bot label. The sketch stores no raw values.
- 06
Discard
The operational token and transient sensitive inputs are cleared after use. Aggregate counters and sketches remain for reporting. Separate security retention and window-key destruction require their own evidence.
Window-bound keys, with destruction that must be verified.
Counting unique visitors needs a way to recognise a repeat. INSIGHTS derives a token per request, uses it to update a probabilistic sketch, then destroys it. The token never enters a log, a trace, a queue, a cache, an error message or any durable store.
Plaintext salts are held in locked process memory. Wrapped salt material may be retained for recovery during a live window. At closure, memory zeroisation, wrapped-row deletion and wrapping-key destruction each need evidence. The design requirement is not proof that a particular production deadline was met.
Windows are restricted to 1, 7, 14 or 30 days, and a tenant’s jurisdiction profile constrains which they may select. A profile name is not legal authorisation; a 30-day window also needs its own current approval.
token = HMAC-SHA256( salt[tenant, window], truncated_ip ‖ ua_family ‖ country ‖ time_bucket )
Reach is estimated inside a privacy window, never linked across one.
A fixed-precision HyperLogLog sketch estimates unique reach inside a privacy window. The response includes a 90% interval and the estimator’s relative standard error.
Sketches produced under different window salts are not joined to recognise a returning visitor. The beta therefore reports a named single-window reach and does not turn daily estimates into a claimed monthly unique count.
What you get
- Measured pageviews by page group, country, device and network, for consenting visitors and, on the anonymous lane, for the visitors your banner never reached.
- Unique reach inside each privacy window, estimated and shown with its error.
- Monthly reach modelled from a calibrated revisit factor, always with a confidence band, never dressed up as a count.
- Suppressed cells where a group is too small to show, and a report header that says which visitors every number covers.
Illustrative figures, not live customer data.
Small groups are withheld, not estimated.
When a cell falls below the suppression threshold it is returned as suppressed. Query restrictions and non-differencing controls are designed to prevent reconstructing withheld cells from other responses. Suppression does not remove the need for an authorised collection purpose.