Compliance
Last updated: August 10, 2026
This page is the short, factual version of our data posture, written for the person who has to fill in a vendor review form. It says what is true today, including the parts that are not flattering. The privacy policy is the binding document; this page exists so you do not have to read it to answer three questions.
Certifications
rtcStats is not SOC 2, ISO 27001 or HIPAA certified. We are a small team and we have not been through those audits. If a certification is a hard requirement for you, tell us and we will say plainly whether it is on our roadmap rather than leaving you to guess.
What we can do instead is remove the need for the audit. The collection layer is open source and self-hostable, so the sensitive data can stay inside your infrastructure and only the parts you choose ever reach us. That is a stronger answer than a certificate for most WebRTC teams, and it is available on the free tier.
The short answers
What data do you hold?
WebRTC statistics: the output of getStats, ICE candidate and connection metadata, device and browser information, and whatever identifiers you choose to attach to a session (user id, conference id, session id, title). Plus the account data needed to run the service: name, email, team membership.
We do not receive audio or video media. rtcStats analyzes statistics about a call, never its content.
Where does it live?
The hosted service runs in the United States. If you are in the EU or UK, data you send us is transferred to and stored in the United States.
On some plans the collected data can stay on your own servers or with your own provider, with only the analysis running on ours.
How long do you keep it?
Each plan carries a retention period: the window in which we show you a session and guarantee it is stored. It is set by plan, can be extended per account, and is published in machine-readable form at /finops.json (guaranteedRetentionDays).
Past that window the guarantee ends. Files and analysis results may be permanently removed, and there is no guarantee as to the time of removal. So treat the retention period as the longest you can rely on a session being there, not as a deletion date. More detail in data privacy and compliance.
You can delete an individual session at any time through the dashboard or with DELETE /v1.0/sessions/{rtcstatsId}.
Can I avoid sending you identifiable data at all?
Yes, and we wrote the guide for it: anonymizing dumps. The identifiers in a dump are the ones you put there, so they are the ones you can strip.
How is it protected in transit and at rest?
TLS on every connection. Database backups are encrypted. API access uses per-account application tokens that you can revoke from the dashboard.
How do I report a vulnerability?
/.well-known/security.txt or support@rtcstats.com. We will acknowledge and tell you what we are doing about it.
Sub-processors
Third parties that process data on our behalf in order to run the hosted service.
| Sub-processor | Purpose | Data involved | Region |
|---|---|---|---|
| Vercel | Application hosting, edge network, and the AI Gateway that routes summary generation | Request metadata, application logs, dump content in transit during analysis | United States |
| Supabase | Database, authentication and object storage | Account records, session analyses, uploaded dumps | United States |
| Large language model providers (via the Vercel AI Gateway) | Generating the plain-English summary of a session | Derived metrics and observations for the session being summarized | United States |
| Resend | Transactional email (sign-up, invitations, password reset, digests) | Email address, name | United States |
| Crisp | In-app support chat | Email address, name, chat transcript | European Union |
| Kit | Product and marketing email to people who opted in | Email address, name | United States |
| Google Analytics | Aggregate website analytics on the marketing pages | Pseudonymous usage events | United States |
Questions this page does not answer
Ask us. A vendor review that needs a DPA, a specific retention commitment, or a deployment where nothing leaves your VPC is a conversation, not a form.
Contact us