No certifications yet
Every item here is implemented and, where it is testable, tested in the automated suite that gates every commit.
Everything is stored in the United Kingdom: events, rated rows, plans, statements and backups. One region, stated plainly — we would rather name the country than offer a menu we cannot honour. If you need another, ask, and we will tell you honestly whether we can.
Every connection is TLS. Data at rest is encrypted on the underlying volumes, including database, event storage and backups.
Every row of every table is scoped to a tenant, and every read and write endpoint is tested against another tenant's key in the automated test suite. An event you cannot see is an event that is not yours.
Keys are stored hashed, never in plain text and never in logs. They are revocable, they record when they were last used, and ingest keys (pk_live_) cannot read anything back.
One click exports every event, rated row, price plan and statement in open formats — during the trial, during your subscription, and after you cancel. No export fee and no notice period.
Payment collection is out of scope by design. We rate usage and produce statements; money movement stays with you or your own payment provider. That keeps a whole category of regulatory risk off both of us.
Written here so you can hold us to it. None of the following is in place.
The certification we intend to hold first, because it is proportionate to our size and genuinely meaningful. Not yet started, and we will date it here when it is.
On the roadmap, and honestly further out than a marketing page usually admits. SOC 2 requires an observation window; nobody can hold it in their first year of trading. We will publish the start of the window when it opens.
We intend to commission an external test before general availability and publish the summary, including what it found. A test whose results you cannot see is not evidence.
The current status page is static. Live component monitoring and incident history land at launch.
Typecheck, lint, unit tests, integration tests against real Postgres and ClickHouse, a tenant-isolation suite, and rating fixtures asserted to four decimal places. A red pipeline blocks the merge. Coverage floors are 90% on the rating and ingest modules.
The properties object on an event is free-form and comes from you, so it is escaped everywhere it is displayed and parameterised everywhere it is queried. It is never interpolated into a query.
If storage is unavailable, events buffer to disk and replay. If an event cannot be rated, it is held in an unrated state and surfaced, never billed at zero. Both behaviours are tested by killing the process mid-run.
Send it to security@thepixeldata.com. We acknowledge within one working day, we will keep you updated while we fix it, and we will not take legal action against good-faith research. If you would like credit in the fix notes, say so and you will get it.
If your procurement process needs a certification we do not hold, tell us early rather than late — we would rather say "not yet, here is when" than waste your evaluation cycle. Get in touch and you will get a straight answer from an engineer.
The sandbox needs no signup and no card, and nothing you do in it is stored.