What is data sovereignty in analytics?

Data sovereignty means your organization retains full ownership and control over where customer data is stored, who can access it, how long it is retained, and how it can be exported. ClickStream ensures data sovereignty through per-site AES-256-GCM encryption, regional R2 storage, and on-demand Parquet exports.

How should PII be handled in a clickstream analytics platform?

PII in clickstream data — emails, phone numbers, IP addresses — should be hashed or encrypted at collection, stored with per-tenant encryption keys, and subject to configurable retention policies. ClickStream hashes PII at the edge before storage and provides 90-day TTL defaults with customizable retention windows.

What is AES-256-GCM encryption and why does it matter for analytics?

AES-256-GCM is a symmetric encryption standard that provides both confidentiality and data integrity verification. ClickStream uses per-site AES-256-GCM keys to encrypt behavioral data at rest, ensuring that even in a storage breach, no tenant's data can be decrypted without their unique key.

Data Sovereignty & PII Architecture | ClickStream Whitepaper

Abstract

Data sovereignty is not a feature; it is an architectural decision that must be made at the foundation of any analytics platform. ClickStream's data architecture ensures that personally identifiable information (PII) is encrypted at rest with AES-256-GCM using per-site encryption keys, hashed with a dual-hash strategy (SHA-256 for internal identity resolution, MD5 for ad-tech compatibility), automatically scrubbed after a configurable 90-day TTL, and exportable in Parquet format from ClickStream-managed Cloudflare R2 infrastructure. This whitepaper details every layer of the privacy architecture, from the encryption envelope to GDPR Article 17 (right to erasure) compliance, CCPA opt-out mechanics, and Schrems II positioning for EU-US data transfers.

The Data Sovereignty Threat Model
AES-256-GCM Per-Site Encryption
Dual-Hash PII Strategy
90-Day TTL Auto-Scrubbing
Parquet Exports to R2
Data Classification Tiers
GDPR Compliance Architecture
CCPA/CPRA Compliance
Schrems II and EU-US Data Transfers
Right to Erasure Implementation
Conclusion

1. The Data Sovereignty Threat Model

Most analytics platforms operate on a trust model where the customer sends their visitor data to a vendor-controlled infrastructure, hopes the vendor handles it properly, and has no meaningful audit capability. This model has failed repeatedly: data breaches at third-party analytics providers, unauthorized data sharing with advertising networks, and regulatory penalties for customers who delegated data processing to non-compliant vendors.

ClickStream's data sovereignty architecture addresses four threat categories:

Vendor breach: If ClickStream's infrastructure is compromised, per-site encryption ensures that the attacker cannot decrypt data for any customer without that customer's specific encryption key.
Cross-customer leakage: Multi-tenant analytics platforms risk data mixing between customers. Per-site encryption with isolated keys makes cross-customer access cryptographically impossible.
Regulatory exposure: GDPR, CCPA, LGPD, and other regulations impose strict requirements on data processing, retention, and deletion. The architecture enforces compliance automatically, not through policy documents.
Third-party data sharing: Ad-tech integrations historically leaked PII to third parties. The dual-hash strategy ensures that only irreversible hashes leave the encrypted envelope, never raw PII.

2. AES-256-GCM Per-Site Encryption

Every customer site in ClickStream receives a unique 256-bit AES encryption key. All PII data is encrypted at the edge worker before being written to any data store.

2.1 Encryption Envelope

// Encryption at the edge worker async function encryptPII(plaintext: string, siteKey: CryptoKey): Promise<string> { const iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit IV const encoded = new TextEncoder().encode(plaintext); const ciphertext = await crypto.subtle.encrypt( { name: 'AES-GCM', iv: iv, tagLength: 128 }, siteKey, encoded ); // Concatenate IV + ciphertext + auth tag const result = new Uint8Array(iv.length + ciphertext.byteLength); result.set(iv); result.set(new Uint8Array(ciphertext), iv.length); return btoa(String.fromCharCode(...result)); }

2.2 Key Management

Aspect	Implementation
Key generation	256-bit random key generated at site onboarding via Web Crypto API
Key storage	Cloudflare Workers KV, encrypted at rest by Cloudflare
Key rotation	Optional quarterly rotation; old keys retained for decryption of historical data
Key access	Only the edge worker serving that customer's CNAME has access to that key
Key deletion	Customer can request key destruction, rendering all stored data permanently undecryptable
Algorithm	AES-256-GCM with 96-bit IV and 128-bit authentication tag

2.3 What Gets Encrypted

Not all data requires encryption. ClickStream classifies fields into three categories:

Category	Examples	Treatment
PII (encrypted)	Email, phone, IP address, hashed email	AES-256-GCM encrypted before storage
Pseudonymous (hashed)	Visitor ID, session ID, device signature	Already pseudonymous; stored as-is
Behavioral (plaintext)	Scroll depth, click count, page URL, scores	Non-identifying; stored in plaintext for analytics

The encryption boundary is the critical design decision: encrypt everything that could identify a natural person, hash everything that serves as an identity linkage, and leave behavioral data unencrypted for analytics performance.

3. Dual-Hash PII Strategy

When a visitor provides an email address (through form submission, login, or checkout), ClickStream generates two irreversible hashes:

3.1 SHA-256 (Internal Identity)

// SHA-256 for internal identity graph const sha256Hash = await crypto.subtle.digest( 'SHA-256', new TextEncoder().encode(email.toLowerCase().trim()) ); const internalId = Array.from(new Uint8Array(sha256Hash)) .map(b => b.toString(16).padStart(2, '0')) .join('');

The SHA-256 hash is used exclusively within ClickStream's identity graph. It links visitor sessions, resolves cross-device identities, and powers the behavioral profile. SHA-256 is cryptographically secure and computationally infeasible to reverse.

3.2 MD5 (Ad-Tech Compatibility)

// MD5 for ad-tech identity sync (DSPs, demand-side platforms) const md5Hash = md5(email.toLowerCase().trim());

The MD5 hash exists solely for compatibility with ad-tech platforms. Most demand-side platforms expect MD5-hashed email addresses as their identity key. While MD5 is not cryptographically secure (collision attacks exist), it is an industry standard for this specific use case and does not expose raw PII.

3.3 Hash Comparison

Attribute	SHA-256 (Internal)	MD5 (Ad-Tech)
Purpose	Identity graph resolution	Ad platform audience matching
Security level	Cryptographically secure	Industry-standard (not collision-resistant)
Stored where	D1 identity graph	Only sent to ad platforms on demand
Reversible	No	Theoretically via rainbow tables (mitigated by salting in transit)
Shared externally	Never	Only to configured ad-tech partners

The raw email address is encrypted with AES-256-GCM and stored in the PII envelope. The hashes exist independently. Even if the encryption key is lost, the hashes remain functional for identity resolution.

4. 90-Day TTL Auto-Scrubbing

All behavioral event data has a default time-to-live (TTL) of 90 days. After 90 days, event-level data is automatically and irreversibly deleted from both the Analytics Engine and D1.

4.1 What Gets Scrubbed

Data Type	TTL	After Expiry
Raw event data (page views, clicks, etc.)	90 days	Permanently deleted from Analytics Engine
Behavioral scores per session	90 days	Deleted from D1; aggregated scores retained
IP addresses (encrypted)	90 days	Deleted; IP-based geo already resolved at write time
Identity graph nodes	Configurable (default: 400 days)	Node and all edges deleted
Aggregated analytics	No TTL	Retained indefinitely (non-identifying)
Parquet exports	Customer-controlled	Stored on ClickStream's R2 infrastructure; customers can export and manage their own retention

4.2 Scrubbing Implementation

Auto-scrubbing is implemented as a Cloudflare Cron Trigger that runs daily:

// Scheduled daily scrub (Cron Trigger) export default { async scheduled(event, env, ctx) { const cutoff = Date.now() - (90 * 24 * 60 * 60 * 1000); // Delete expired events from D1 await env.DB.prepare( `DELETE FROM events WHERE created_at < ?` ).bind(cutoff).run(); // Delete expired sessions await env.DB.prepare( `DELETE FROM sessions WHERE last_active < ?` ).bind(cutoff).run(); // Delete expired PII envelopes await env.DB.prepare( `DELETE FROM pii_store WHERE created_at < ?` ).bind(cutoff).run(); // Analytics Engine handles its own TTL natively } };

5. Parquet Exports to R2

Customers can configure automatic daily exports of their analytics data to ClickStream-managed Cloudflare R2 infrastructure in Apache Parquet format. This ensures full data portability and export freedom.

5.1 Export Format

Attribute	Value
Format	Apache Parquet (columnar)
Compression	Snappy
Partitioning	By date (YYYY/MM/DD/)
Schema	Mirrors Analytics Engine blob/double mapping
PII handling	PII fields remain encrypted in export
File size	~50–200 MB per day per site (depends on traffic)
Storage location	ClickStream-managed R2 infrastructure
Retention	Configurable; customers can export data at any time for their own retention needs

5.2 Export Path Structure

s3://customer-bucket/clickstream/ events/ 2026/03/10/events-20260310-001.parquet 2026/03/10/events-20260310-002.parquet scores/ 2026/03/10/scores-20260310-001.parquet identity/ 2026/03/10/identity-graph-20260310.parquet

Customers can query Parquet exports directly using standard tools: DuckDB, Apache Spark, Pandas, Polars, Amazon Athena, or any SQL engine that supports Parquet. This eliminates vendor lock-in — even if a customer leaves ClickStream, they retain all their historical data in an open format.

6. Data Classification Tiers

ClickStream classifies all data into four tiers with progressively stricter handling requirements:

Tier	Classification	Examples	Encryption	TTL	Export
Tier 1	Direct PII	Email, phone, name	AES-256-GCM	90 days (or custom)	Encrypted in export
Tier 2	Indirect PII	IP address, precise geolocation	AES-256-GCM	90 days	Encrypted or omitted
Tier 3	Pseudonymous	Visitor ID, session ID, hashes	None (already pseudonymous)	400 days	Included
Tier 4	Behavioral / Aggregate	Scores, page URLs, timestamps	None	90 days (events) / indefinite (aggregates)	Included

ClickStream's architecture addresses GDPR requirements structurally, not through policy alone:

GDPR Article	Requirement	ClickStream Implementation
Art. 5(1)(e)	Storage limitation	90-day TTL with automated scrubbing
Art. 5(1)(f)	Integrity and confidentiality	AES-256-GCM encryption at rest
Art. 6	Lawful basis	CMP integration for consent management
Art. 7	Conditions for consent	SDK checks consent before setting cookies
Art. 15	Right of access	API endpoint for data subject access requests (DSAR)
Art. 17	Right to erasure	Cascade delete across all data stores within 72 hours
Art. 20	Data portability	Parquet exports in open format
Art. 25	Data protection by design	Encryption, hashing, TTL, and minimization are architectural defaults
Art. 28	Processor obligations	Standard DPA provided; sub-processor list: Cloudflare only
Art. 32	Security of processing	AES-256-GCM + TLS 1.3 in transit + isolated worker environments
Art. 33	Breach notification	Automated anomaly detection on data access patterns
Art. 35	Data protection impact assessment	DPIA template provided to customers

8. CCPA/CPRA Compliance

California's CCPA and its successor CPRA impose specific requirements for opt-out mechanics and data selling prohibitions:

Do Not Sell My Personal Information: ClickStream never sells personal information. Behavioral data is computed and stored for the customer's exclusive use. The dual-hash strategy for ad-tech integration only sends irreversible hashes, not personal information.
Right to Delete: Implemented identically to GDPR Art. 17. Cascade deletion across all data stores within 72 hours.
Right to Know: DSAR API returns all data associated with a visitor ID or email hash within 30 days (statutory requirement: 45 days).
Opt-out signal (GPC): The SDK detects the Global Privacy Control (GPC) signal (navigator.globalPrivacyControl) and treats it as a valid opt-out. No cookies are set and only session-level, non-identifying data is collected.
Sensitive personal information: ClickStream does not collect sensitive personal information (SSN, financial account numbers, precise geolocation for inferring protected characteristics, etc.).

9. Schrems II and EU-US Data Transfers

The Schrems II ruling invalidated the EU-US Privacy Shield, creating uncertainty around transatlantic data transfers. ClickStream's architecture is designed to minimize transfer risk:

9.1 Data Localization

Cloudflare's edge network processes data at the nearest edge location to the visitor. For EU visitors, data is processed at EU edge locations (Frankfurt, Amsterdam, Paris, Dublin, etc.). The data does not need to transit to US data centers for processing.

9.2 Supplementary Measures

Measure	Implementation
Encryption in transit	TLS 1.3 for all connections
Encryption at rest	AES-256-GCM with per-site keys
Pseudonymization	SHA-256 hashing of PII at ingestion
Data minimization	Only necessary fields collected; 90-day TTL
Access control	No human access to encrypted PII without customer authorization
Transparency	Sub-processor list limited to Cloudflare; updated with notice

9.3 EU-Only Processing Option

Enterprise customers can configure ClickStream to restrict data processing to EU-only edge locations. This is implemented via Cloudflare's Data Localization Suite, which pins data storage and processing to specific geographic regions. When enabled, no visitor data from EU visitors leaves EU jurisdiction, even in encrypted form.

10. Right to Erasure Implementation

When a data subject exercises their right to erasure (GDPR Art. 17 or CCPA right to delete), ClickStream executes a cascade deletion across all data stores:

10.1 Deletion Flow

Request received: Via customer API or ClickStream dashboard. Identifier: visitor ID, email hash, or raw email.
Identity resolution: The identity graph resolves all linked identifiers (visitor IDs, session IDs, email hashes, device signatures) for the data subject.
D1 deletion: All rows in all tables referencing any of the resolved identifiers are deleted.
PII envelope destruction: The encrypted PII envelope for the data subject is deleted.
Analytics Engine: Event-level data in Analytics Engine is flagged for exclusion from queries (Analytics Engine does not support row-level deletion, but TTL will naturally expire these events within 90 days).
Parquet exports: A deletion manifest is generated and included in subsequent Parquet exports, listing the identifiers to exclude from any downstream processing.
Confirmation: A deletion receipt with timestamp and scope is returned to the customer.

10.2 Deletion Timing

Data Store	Deletion Time	Method
D1 (relational)	< 1 hour	SQL DELETE with cascade
Workers KV (PII envelope)	< 1 hour	KV delete
Analytics Engine (events)	Up to 90 days (TTL)	Query-time exclusion + natural expiry
Parquet exports	N/A (customer-controlled)	Deletion manifest provided

11. Conclusion

Data sovereignty cannot be bolted on after the fact. It must be architectural. ClickStream's approach — per-site AES-256-GCM encryption, dual-hash PII strategy, 90-day automatic scrubbing, Parquet exports from managed infrastructure, and structural GDPR/CCPA compliance — ensures that data sovereignty is not a marketing claim but a cryptographic reality.

The key principles are simple: encrypt everything identifying, hash everything that serves as a linkage, automatically delete everything beyond the retention window, and give customers full export capability in open formats. No vendor lock-in. No data hostage situations. No compliance theater.

In a regulatory landscape that is tightening globally — the EU AI Act, Brazil's LGPD, India's DPDP Act, China's PIPL — organizations need analytics infrastructure that is not just compliant today but architecturally resilient to future regulation. ClickStream's privacy-first architecture provides that foundation.

Data Sovereignty & PII Architecture

Abstract

Table of Contents

1. The Data Sovereignty Threat Model

2. AES-256-GCM Per-Site Encryption

2.1 Encryption Envelope

2.2 Key Management

2.3 What Gets Encrypted

3. Dual-Hash PII Strategy

3.1 SHA-256 (Internal Identity)

3.2 MD5 (Ad-Tech Compatibility)

3.3 Hash Comparison

4. 90-Day TTL Auto-Scrubbing

4.1 What Gets Scrubbed

4.2 Scrubbing Implementation

5. Parquet Exports to R2

5.1 Export Format

5.2 Export Path Structure

6. Data Classification Tiers

8. CCPA/CPRA Compliance

9. Schrems II and EU-US Data Transfers

9.1 Data Localization

9.2 Supplementary Measures

9.3 EU-Only Processing Option

10. Right to Erasure Implementation

10.1 Deletion Flow

10.2 Deletion Timing

11. Conclusion

Own Your Data. Protect Your Revenue.

Data Sovereignty & PII Architecture

Abstract

Table of Contents

1. The Data Sovereignty Threat Model

2. AES-256-GCM Per-Site Encryption

2.1 Encryption Envelope

2.2 Key Management

2.3 What Gets Encrypted

3. Dual-Hash PII Strategy

3.1 SHA-256 (Internal Identity)

3.2 MD5 (Ad-Tech Compatibility)

3.3 Hash Comparison

4. 90-Day TTL Auto-Scrubbing

4.1 What Gets Scrubbed

4.2 Scrubbing Implementation

5. Parquet Exports to R2

5.1 Export Format

5.2 Export Path Structure

6. Data Classification Tiers

7. GDPR Compliance Architecture

8. CCPA/CPRA Compliance

9. Schrems II and EU-US Data Transfers

9.1 Data Localization

9.2 Supplementary Measures

9.3 EU-Only Processing Option

10. Right to Erasure Implementation

10.1 Deletion Flow

10.2 Deletion Timing

11. Conclusion

Related Whitepapers

First-Party Cookies Are the Gold Standard for Identity

Edge-Computed Behavioral Intelligence

Cross-Device Identity Resolution

Fraud Detection via Behavioral Biometrics

Identity Attribution in Cybercrime Investigations

Own Your Data. Protect Your Revenue.