Skip to content
MetricMaven
Free Tracking Scan

Security and responsibility

How we handle access, data and security reviews.

We make the boundaries, access questions, data paths, and review points explicit so your team can decide whether the engagement fits its own requirements.

Book a 20-minute call

Clear boundaries first

Good security work starts with knowing who owns the decision.

MetricMaven can help operate the agreed measurement layer. We do not replace your organization’s security, privacy, identity, or governance responsibilities.

MetricMaven is responsible for

  • The agreed measurement work
  • The changes we make within scope
  • The validation evidence we produce
  • Clear communication when a finding needs your decision

Your organization is responsible for

  • Your warehouse, cloud and reporting accounts
  • Identity policies and source-system permissions
  • Business definitions
  • The approvals required by your own governance process

Before and during the work

Questions we make visible together.

The specific controls depend on your architecture and requirements. These are the operating conversations we expect to have, not a certification claim.

  1. 01

    Access boundaries

    Agree who can see and change what. Access is scoped around the systems and work required for the engagement. We document the owners, destinations, and approval points with your team before implementation.

  2. 02

    Data handling

    Move only the data the work calls for. Data destinations and handling expectations are part of the engagement scope. We work with your team to define what belongs in marketing systems and what should remain out of them.

  3. 03

    Change review

    Review before a repair becomes relied upon. Tracking, pipeline, and reporting changes have a reason, an expected effect, and a validation path. Findings that affect your business definitions stay visible for your approval.

  4. 04

    Offboarding

    Close the loop with a documented handover. At the end of an engagement, your team can revoke access, receive the agreed documentation, and confirm the remaining owners and operating procedures.

Data handling

Where the data sits and how it is handled.

Where measurement data is stored during an engagement and how it is handled.

Credentials

We connect through official OAuth and platform APIs and never ask for your passwords. You can revoke our access from each platform at any time.

Hosting

Marketing data is modeled in a managed Google BigQuery warehouse. Qualified portfolio and agency engagements can transfer modeled data into a warehouse your organization owns.

Encryption

Data is encrypted in transit over TLS. Data in the BigQuery warehouse is encrypted at rest by Google Cloud.

Export and deletion

You can request an export or a deletion at any time through our data deletion page.

Data processing agreement

Available on request as part of the engagement paperwork.

Attestation status

We are actively pursuing SOC 2 Type II. We are not certified today, and we do not claim to be. Ask us for our current status and a security overview.

Retention periods, subprocessor lists, and incident-notification terms are set per engagement and confirmed in writing before work begins.

Bring your security questionnaire.

Book a 20-minute call with the person who will answer it.

Book a 20-minute call