Company

Security and data handling

CookieConsentHQ stores consent records in Neon Postgres in Frankfurt, with IP addresses truncated at the edge and user agents stored as SHA-256 hashes. Admin access goes through Cloudflare Access, an allowlisted email sign-in, an authenticator code and an audit log.

Add your site freeFree up to 25,000 pageviews a month.

Consent record database: Neon Postgres; Frankfurt, Germany
IP handling: IPv4 last octet removed; IPv6 cut to /48
User agent: SHA-256 hash stored instead of raw value
Customer sign-in: Emailed sign-in links; no stored passwords
Admin sign-in: Cloudflare Access; email allowlist; authenticator code
Certifications: No SOC 2 or ISO 27001 certification

CookieConsentHQ stores customer consent records in a Neon Postgres database in Frankfurt, Germany, on AWS eu-central-1. The application runs on Vercel functions in Frankfurt behind a global CDN.

Each consent record holds a consent ID, UTC timestamp, action, chosen categories, banner configuration version and location. It also holds the page path, whether Global Privacy Control was sent and the reduced visitor identifiers described below.

Retention depends on the plan: one year on Free, three years on Starter and five years on Growth, Business and Agency.

The consent log page explains the stored fields, CSV export and single-record lookup.

The database location is where consent records live. Some of the providers listed below process other data elsewhere.

Which service providers does CookieConsentHQ use?

CookieConsentHQ uses outside providers for content delivery, hosting, the database, payments, email and AI cookie classification. Each runs in the region that fits its service.

Provider	Purpose	Where
Cloudflare	CDN, edge workers, storage and security	Global edge network
Vercel	Application hosting	Functions in Frankfurt, Germany; global CDN
Neon	Postgres database	Frankfurt, Germany; AWS eu-central-1
Paddle	Billing and merchant of record	Paddle's own infrastructure
Resend	Transactional email	Sending region in Tokyo, Japan
Anthropic	AI classification of unknown cookie names	United States

Anthropic only receives the names and domains of cookies the built-in database doesn't recognize, so the scanner can suggest a category. No visitor data is sent.

The privacy policy and the data processing agreement set out how personal data is handled.

The edge truncates visitor IP addresses and hashes the user agent with SHA-256 before a consent record is stored. Consent records therefore contain neither the full IP address nor the raw user-agent string.

For IPv4, truncation removes the last octet. For IPv6, the address is cut to a /48 prefix.

The banner sets one first-party consent cookie on customer websites.

Truncated and hashed identifiers can still count as personal data under some privacy laws, so this is data minimization rather than anonymization.

A website can read a visitor's consent ID with CCHQ.getConsent().id, for example to add it to a privacy request form. The site owner then opens that record by ID in the dashboard.

How are customer accounts and payments protected?

Customers sign in with emailed links, so there are no customer passwords to store or leak. Paddle handles card details as merchant of record, and CookieConsentHQ never receives card numbers.

Billing events arrive from Paddle as webhooks, and CookieConsentHQ checks each webhook's signature before acting on it.

How is the internal admin panel secured?

The internal admin panel runs on a separate, unlisted host behind Cloudflare Access. Getting in also needs an allowlisted email sign-in and a code from an authenticator app.

Requests that try to reach the admin host without passing through Cloudflare are refused. Repeated wrong authenticator codes lock sign-in for a period.

Every admin action is written to an audit log.

How are secrets and backups handled?

Application secrets live in the hosting providers' encrypted environment settings and never in the code repository. The database can be restored to an earlier point in time through Neon.

This page does not promise a recovery time, a backup retention window or an uptime figure.

Which browser security headers are set?

CookieConsentHQ sends HTTP Strict Transport Security for two years, including subdomains. It also sets content-type, referrer, permissions and framing headers.

The headers are:

Strict-Transport-Security for two years, including subdomains.
X-Content-Type-Options: nosniff.
Referrer-Policy: strict-origin-when-cross-origin.
A Permissions-Policy that turns off camera, microphone and geolocation.
X-Frame-Options, set to deny framing on the admin panel.

What certifications and reporting options are there?

CookieConsentHQ does not hold SOC 2 or ISO 27001 certification and has no bug bounty program. Report security issues to support@cookieconsenthq.com.

If your procurement rules require independently certified vendors, take that into account.

The About page says who runs the service. This page describes arrangements as of 20 October 2026 and is not legal advice.

Questions

Where are consent records stored?

In Neon Postgres in Frankfurt, Germany, on AWS eu-central-1.

Does CookieConsentHQ store full visitor IP addresses?

No. The edge removes the last octet of IPv4 addresses and cuts IPv6 addresses to /48 before anything is stored.

Does CookieConsentHQ store payment card numbers?

No. Paddle is the merchant of record and handles card details on its own infrastructure.

How is the admin panel protected?

It runs on a separate unlisted host behind Cloudflare Access and needs an allowlisted email sign-in plus an authenticator code. Repeated wrong codes lock sign-in for a while.

Does CookieConsentHQ have SOC 2 or ISO 27001 certification?

No. CookieConsentHQ holds neither certification and has no bug bounty program. Send security reports to support@cookieconsenthq.com.