PathlyAudit my site

Security & GDPR

Security and GDPR: what Pathly does with your data

Before you trust a tool with your clients’ sites, you want to know where the data goes, who processes it and how it is protected. Here are the answers, with the documents that commit us to them.

Updated: 30 October 2026

Where your data lives

  • The app, the API, the probes, the database and the screenshots are hosted on Google Cloud, in the europe-west1 region (Belgium, European Union).
  • Probes leave from a single measuring point, eu-west. There is no other operational region today.
  • Database backups stay in the same region.
  • Public traffic goes through Cloudflare (DNS, CDN, firewall). Cloudflare is a US company: the transfer relies on the EU–US Data Privacy Framework, supplemented by the standard contractual clauses.

Who processes your data

  • For your organization’s data, you are the controller. Elerine, which publishes Pathly in Spain, acts as processor, on your instructions.
  • Sub-processors: Google Cloud (Ireland, europe-west1 region) for hosting and AI failure explanations, Cloudflare (United States) for the network and the sign-in bot check, Mollie (Netherlands) for payments, Brevo (France) for emails, Google Workspace (Ireland) for mailboxes and support, Discord (United States) for internal notifications that mention the workspace name and its plan, Invopop (Spain) for invoices, once activated.
  • For a provider established outside the European Union, the transfer is covered by an adequacy decision, including the Data Privacy Framework, or by the European Commission’s standard contractual clauses.
  • We do not add a sub-processor without informing you.

Data processing agreement (DPA)

  • The data processing agreement required by article 28 GDPR is published online in the site’s four languages. It supplements the terms of service.
  • If a personal data breach affects your organization, we notify you without undue delay, and no later than 48 hours after discovering it.
  • An instruction, a reasonable audit request or a deletion request: privacy@pathlyhq.com.

Encryption

  • In transit: HTTPS everywhere, with HSTS. The database has no public address and only accepts encrypted connections.
  • At rest: Google Cloud default encryption for the database, screenshot storage and secrets.
  • On top of that, in the application: your scenario and webhook secrets are encrypted with AES-256-GCM, passwords hashed with bcrypt, session tokens hashed.

Screenshots and retention

  • Failure screenshots and videos sit in private storage. Only the API reads them, for the members of your workspace. The link in an alert email is signed and valid for 7 days.
  • Runs, their screenshots and their videos are erased by a daily purge once your plan’s retention has passed: 7 days on Solo, 30 days on Freelance, 90 days on Pro and Business.
  • For a Flow, we recommend a test account rather than a real customer account.

Backups

  • The database is backed up every day, and each backup is kept for 7 days.
  • It can also be restored to a precise moment within the last 7 days.
  • The production database is protected against deletion.

Accounts and access

  • Two-factor authentication (TOTP) with backup codes, available for every account.
  • You can see and close your open sessions from the console.
  • Sign-in is protected by an attempt limit and a bot check (Cloudflare Turnstile).
  • On Pathly’s side, the internal console sits behind Cloudflare Access, and every access by an administrator to a customer workspace is logged.

Artificial intelligence

  • The AI failure explanation is optional. It only runs when you ask for it, never automatically.
  • It goes through Google Cloud Vertex AI, in the europe-west1 region. The analysis region is locked to the European Union.
  • Only textual facts are sent, with sensitive values masked. Never a screenshot, a video or page content.
  • Google commits by contract not to use this content to train its models.

Your rights

  • From the console, an administrator exports the workspace data as JSON, and everyone can export their own data. Deleting the account or the workspace happens in the same place.
  • Any other request: privacy@pathlyhq.com. Answer within one month.
  • Supervisory authority: the AEPD (Agencia Española de Protección de Datos), as Elerine is established in Spain.

Before every release

  • Every change goes through a pull request and continuous integration: tests, secret scanning (gitleaks), static analysis (Semgrep), dependency audit, infrastructure checks (Trivy).
  • A new version only gets all the traffic after a 10% stage under the error threshold and a green smoke test. Otherwise, it rolls back to the previous version.

Service status

  • Pathly’s status page shows the live state of the API, the database and the probes.

Report a vulnerability

Pathly holds no security certification to date. This page describes the measures in place, which you can check against our public documents: privacy policy, DPA and legal notice.