Data Sovereignty & PII Architecture

1. The Data Sovereignty Threat Model

Most analytics platforms operate on a trust model where the customer sends their visitor data to a vendor-controlled infrastructure, hopes the vendor handles it properly, and has no meaningful audit capability. This model has failed repeatedly: data breaches at third-party analytics providers, unauthorized data sharing with advertising networks, and regulatory penalties for customers who delegated data processing to non-compliant vendors.

ClickStream's data sovereignty architecture addresses four threat categories:

• Vendor breach: If ClickStream's infrastructure is compromised, per-site encryption ensures that an attacker cannot decrypt any customer's stored contact fields or encrypted exports without that customer's specific encryption key — and analytics storage holds only hashed identifiers, never raw PII.
• Cross-customer leakage: Multi-tenant analytics platforms risk data mixing between customers. Per-site encryption keys, per-tenant HMAC identity hashing, and tenant-scoped analytics indexes keep each customer's data isolated — two tenants' data cannot be joined, and one tenant's PII cannot be decrypted with another's key.
• Regulatory exposure: GDPR, CCPA, LGPD, and other regulations impose strict requirements on data processing, retention, and deletion. The architecture enforces compliance automatically, not through policy documents.
• Third-party data sharing: Ad-tech integrations historically leaked PII to third parties. The dual-hash strategy ensures that only irreversible hashes leave the encrypted envelope, never raw PII.

2. AES-256-GCM Per-Site Encryption

Every customer site in ClickStream receives a unique 256-bit AES encryption key. PII is neutralized at the edge before storage: analytics storage holds hashed identifiers only (HMAC-SHA-256 and MD5 email hashes, hashed phone, SHA-256 IP hash — never raw values), while raw contact fields are AES-256-GCM encrypted with per-site keys and gated behind an audited, password-protected reveal workflow.

2.1 Encryption Envelope

2.2 Key Management

2.3 What Gets Encrypted

Not all data requires encryption. ClickStream classifies fields into three categories:

The encryption boundary is the critical design decision: encrypt everything that could identify a natural person, hash everything that serves as an identity linkage, and leave behavioral data unencrypted for analytics performance.

3. Dual-Hash PII Strategy

When a visitor provides an email address (through form submission, login, or checkout), ClickStream generates two irreversible hashes:

3.1 SHA-256 (Internal Identity)

The SHA-256 hash is used exclusively within ClickStream's identity graph. It links visitor sessions, resolves cross-device identities, and powers the behavioral profile. SHA-256 is cryptographically secure and computationally infeasible to reverse.

3.2 MD5 (Ad-Tech Compatibility)

The MD5 hash exists solely for compatibility with ad-tech platforms. Most demand-side platforms expect MD5-hashed email addresses as their identity key. While MD5 is not cryptographically secure (collision attacks exist), it is an industry standard for this specific use case and does not expose raw PII.

3.3 Hash Comparison

The raw email address is encrypted with AES-256-GCM and stored in the PII envelope. The hashes exist independently. Even if the encryption key is lost, the hashes remain functional for identity resolution.

4. 90-Day TTL Auto-Scrubbing

All behavioral event data has a default time-to-live (TTL) of 90 days. After 90 days, event-level data is automatically and irreversibly deleted from both the Analytics Engine and D1.

4.1 What Gets Scrubbed

4.2 Scrubbing Implementation

Auto-scrubbing is implemented as Cloudflare Cron Triggers: an hourly retention purge (with stricter windows for GDPR-strict and HIPAA compliance profiles) plus a nightly export-cleanup job:

5. Parquet Exports to R2

ClickStream's export pipeline writes analytics data to ClickStream-managed Cloudflare R2 in Apache Parquet format — Snappy-compressed, Hive-partitioned, and encrypted per tenant with a key derived from your own site key. Raw-event Parquet exports are available on request on Scale and above today; campaign CSV exports are self-serve on Growth and above.

5.1 Export Format

5.2 Export Path Structure

Parquet is an open columnar format readable by DuckDB, Apache Spark, Pandas, Polars, Amazon Athena, and any Parquet-aware SQL engine — so exported data is never locked to ClickStream's tooling. Raw-event exports are fulfilled on request for Scale+ plans today; campaign CSV exports are self-serve on Growth+.

6. Data Classification Tiers

ClickStream classifies all data into four tiers with progressively stricter handling requirements:

7. GDPR Compliance Architecture

ClickStream's architecture addresses GDPR requirements structurally, not through policy alone:

8. CCPA/CPRA Compliance

California's CCPA and its successor CPRA impose specific requirements for opt-out mechanics and data selling prohibitions:

• Do Not Sell My Personal Information: ClickStream never sells your visitors' data — behavioral data collected on your sites is computed and stored for your exclusive use, and no code path feeds tenant analytics into any data product. Ad-tech integrations receive only irreversible hashes, never raw PII.
• Right to Delete: Implemented identically to GDPR Art. 17. Cascade deletion across all data stores.
• Right to Know: Access requests are handled via support; the identity graph resolves all identifiers linked to the data subject so responses cover the full record.
• Opt-out signals: ClickStream's consent gates and do-not-sell flags let customers honor visitor opt-outs, including opt-out preference signals such as Global Privacy Control (GPC). When a visitor opts out, no cookies are set and only session-level, non-identifying data is collected.
• Sensitive personal information: By design, ClickStream does not collect sensitive personal information — edge-side scrubbing redacts fields such as SSNs and financial account numbers before storage.

9. Schrems II and EU-US Data Transfers

The Schrems II ruling invalidated the EU-US Privacy Shield, creating uncertainty around transatlantic data transfers. ClickStream's architecture is designed to minimize transfer risk:

9.1 Data Localization

Cloudflare's edge network processes requests at the nearest edge location to the visitor. For EU visitors, that typically means EU edge locations such as Frankfurt, Amsterdam, Paris, or Dublin.

9.2 Supplementary Measures

9.3 EU-Only Processing Option

Enterprise customers can contract for EU-only (or US-only) data residency, restricting processing and storage to the selected region.

10. Right to Erasure Implementation

When a data subject exercises their right to erasure (GDPR Art. 17 or CCPA right to delete), ClickStream executes a cascade deletion across all data stores:

10.1 Deletion Flow

1. Request received: Via customer API or ClickStream dashboard. Identifier: visitor ID, email hash, or raw email.
2. Identity resolution: The identity graph resolves all linked identifiers (visitor IDs, session IDs, email hashes, device signatures) for the data subject.
3. D1 deletion: All rows in all tables referencing any of the resolved identifiers are deleted.
4. PII envelope destruction: The encrypted PII envelope for the data subject is deleted.
5. Analytics Engine: Event-level data in Analytics Engine is flagged for exclusion from queries (Analytics Engine does not support row-level deletion, but TTL will naturally expire these events within 90 days).
6. Parquet exports: Erased visitors are excluded from every future export — deletion propagates into the export pipeline automatically.
7. Confirmation: A deletion receipt with timestamp and scope is returned to the customer.

10.2 Deletion Timing

11. Conclusion

Data sovereignty cannot be bolted on after the fact. It must be architectural. ClickStream's approach — per-site AES-256-GCM encryption, dual-hash PII strategy, 90-day automatic scrubbing, on-request per-tenant-encrypted Parquet exports, and structural GDPR/CCPA compliance — ensures that data sovereignty is not a marketing claim but a cryptographic reality.

The key principles are simple: encrypt everything identifying, hash everything that serves as a linkage, automatically delete everything beyond the retention window, and keep exports in open formats — campaign CSV self-serve on Growth and above, raw-event Parquet on request on Scale and above. No compliance theater.

In a regulatory landscape that is tightening globally — the EU AI Act, Brazil's LGPD, India's DPDP Act, China's PIPL — organizations need analytics infrastructure that is not just compliant today but architecturally resilient to future regulation. ClickStream's privacy-first architecture provides that foundation.