Security

Yes.

When someone submits a form on your website, Converly captures the details it needs to report that conversion to your ad platforms. That is usually the lead's name, email address and phone number (though it depends entirely on what your form asks for, if your form does not collect a phone number then neither do we). Alongside that we capture the advertising click ID that brought them to your site, plus their IP address and browser.

We need that information because sending it back to ad platforms is what makes your conversion tracking accurate. Platforms like Google Ads, Meta Ads, etc need that data to match the conversion back to a real person and the original ad they clicked, and without it your ad platform cannot tell which campaigns are actually producing leads.

Two things worth knowing. Before any of it reaches Google or Meta, the contact details are scrambled using a one way process called hashing, so the ad platform receives a fingerprint rather than a readable email address. And we do not keep it for long. The contact details are erased 7 days after the conversion, and the whole record is deleted after 30 days.

Yes, but nothing that wouldn't be publicly accessible.

When you sign up we store the first name, last name, email address and company name. That is the sort of thing anyone could pull from Apollo or ZoomInfo, so it is not generally considered a security risk.

For payments we use Stripe, which is the payments platform that millions of online businesses use. Stripe is PCI certified at the highest level and card numbers never touch Converly at all.

When you connect Google Ads or Meta, Converly holds a credential that lets it send conversions to that account on your behalf. That is genuinely sensitive, so it is kept in a separate encrypted vault rather than in the database your conversions live in. It is never shown in the app, never returned by our API, and only the one service that sends your conversions can read it.

Your data is stored in the United States. Converly itself is an Australian company, and our infrastructure sits in the US with Supabase and Railway.

We do not currently offer EU data residency. If that is a hard requirement for you, let us know and we might be able to figure something out.

A small number of services we rely on to run Converly, and we publish the full list at converly.io/subprocessors with what each one actually handles. The short version is Railway for hosting, Supabase for the database, AWS for delivering the tracking script, Stripe for payments, SendGrid for email, and Sentry for error reporting.

None of them is allowed to use your data for anything other than providing their service to us. If we ever add or change one, we will tell you before it happens.

Converly is a very small team, and access is limited to the people who need it to run the service and help you when something goes wrong.

In practice that means we can see your conversion records for the 30 days they exist, which is what lets us answer a support question like "why did this conversion not reach Google Ads". We cannot see your ad platform credentials, because those sit in a vault that only the sending service can read.

Converly can send conversions to the ad accounts you connect, and that is all it is set up to do. It does not create campaigns, change budgets or touch your ads.

You can disconnect any platform from inside Converly at any time, and you can also revoke our access from within Google, Meta or whichever platform it is, which cuts it off at their end regardless of what we do.

Yes, on every plan. You can turn it on in Settings with an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. Once it's on, you enter a 6-digit code from the app whenever you log in with a password or a login link sent to your email, and you get 10 backup codes in case you lose your phone.

If you log in with your Google or Webflow account, Converly doesn't ask for a code. Your login is protected by that account's own security settings instead. Our help centre has a guide to setting it up.

No. Converly runs on infrastructure that holds SOC 2 Type II, but that is our providers' certification rather than ours.

If your procurement process needs a certification, just ask and we will walk you through where we are at and what we can share in the meantime.

No. We do not use your data or your leads' data to train AI models, and we do not sell it or share it with anyone beyond the services listed above and the ad platforms you have told us to send conversions to.

It is possible to connect an AI assistant like Claude or ChatGPT to your own Converly account to help set up and manage tracking, but no sensitive data is ever shared with it. It cannot read your ad platform credentials and it cannot read your leads' personal details.

Yes. The code behind the Converly dashboard and the service that receives and sends your conversions is scanned automatically by Aikido Security every 3 days. It checks for known vulnerabilities in the open source packages we use, flaws in our own code, and keys or passwords committed by mistake. Our public website is checked weekly.

Every finding is reviewed, and critical and high severity issues are prioritised for fixing.

Yes. Converly is penetration tested by an independent third party every year. The most recent test was carried out by IntegSec in September 2026 and covered the Converly dashboard and API.

Every critical and high severity finding from that test has been fixed. The signed attestation letter is available on request, so just email help@converly.io if your procurement process needs it.

Nothing special needs to happen, because your data was already on its way out. Contact details of your leads are erased 7 days after each conversion and the whole record goes at 30 days, so within a month of your last conversion there is nothing left.

The only exception is if you send signups to us through our API. For those, we keep the reference number your own system sent for each signup for 18 months, so the same signup can never be counted twice. It's your reference for the signup, not the person's contact details.

If we become aware of a breach affecting your data, we will tell you within 72 hours, and we will tell you what happened, what was affected and what we are doing about it.

We will give you what you need to meet your own obligations, because if your leads' data is involved then you have reporting duties of your own and we would rather not be the reason you miss them.

Yes. The database your conversions live in is backed up automatically once a day, and those backups are kept for 7 days.

It is worth understanding how that sits alongside our deletion schedule. We erase your leads' contact details 7 days after a conversion, but a backup taken before that point still holds them until that backup expires. So in the worst case a contact detail can sit in a backup for around a week after it has gone from the live database.

The servers that run Converly do not store anything themselves. All of your data lives in the database, so there is nothing else to back up.

We run three environments, development, testing and production. Changes are built and lightly checked in development, then moved to testing.

In testing we run thousands of automated checks before any changes are pushed to production. This includes testing form builders, scheduling tools, chat widgets, ad platforms and analytics tools we support, across different browsers. Only once those pass does a release go to production.

We also run checks against production on an ongoing basis, so that when a browser or an ad platform changes something we are the first to know.

Yes. Our status page at status.converly.io checks each part of Converly every minute from Cloudflare's network, independently of our own hosting, and shows the last 90 days of uptime and any incidents we've posted.

We would genuinely love to hear from you. Email us at help@converly.io and we will come back to you.

If you think you have found a security vulnerability, email the same address with "Security" in the subject line so it gets picked up quickly.