Data security FAQ

Optimizely Analytics is a warehouse-native analytics platform designed for experimentation and product analytics. You can evaluate the results of A/B experiments against data stored in the customer’s warehouse. This data includes normal in-product events (clicks, form submissions, and so on) and datasets that track broader business metrics like revenue or customer churn. This second class of datasets is typically out of reach for traditional product and experimentation analytics systems because customers are reluctant to share this data with third-party vendors. The warehouse-native architecture lets Optimizely analyze this data while staying within a customer’s data warehouse.

Optimizely Analytics is a fully-hosted SaaS application that connects to a customer’s warehouse using a service account provisioned by the customer. You retain full control of what data is made available to Optimizely Analytics, and you can revoke this access at any time due to security concerns. Modern cloud warehouses provide rich tooling that lets you maintain an audit trail of every query that Optimizely Analytics executes.

The following are some frequently asked questions about data security in Optimizely Analytics.

Customer warehouse administrators control what data is available to Optimizely Analytics. The types of data customers typically expose to Optimizely Analytics depend on their use case. Common examples include product instrumentation events, Optimizely decision events, and any other datasets (revenue, non-event dimensional data, and so on).

This question has two aspects: the personally identifiable information (PII) data of the customer employees and the PII data of the users who use the customer’s product. For the customer employees, Optimizely Analytics stores their name and email address as part of the onboarding process. Optimizely Analytics does not require any PII data for the customer's product users. It requires a unique identifier for each user, but it can be any opaque value. However, a customer may choose to use a user’s email address as their unique identifier for simplicity of setup. This decision is up to the customer, and Optimizely Analytics does not have a say or opinion on the matter.

Optimizely Analytics is SOC-2 Type II compliant, and you can request a copy of the most recent report for your inspection. Optimizely also has a mature security program and is compliant with an even stronger set of security standards (SOC2, GDPR, HIPAA, and so on).

Optimizely Analytics will never make a copy of any customer data. Optimizely Analytics's warehouse-native architecture ensures that customer data never leaves the secure confines of the customer’s data warehouse.

Optimizely Analytics uses Okta as the authentication provider, which is highly secure and versatile. This offers enterprise-class capabilities such as integration with a customer’s corporate identity platform, support for programmatic provisioning of users through SCIM, and so on.

Optimizely Analytics is hosted within AWS. Currently, Optimizely is configured to run in the US-East-1 region and will expand to other regions and clouds as Optimizely customers' needs require.