userGist
Get started

Privacy & PII

userGist ships with a default-deny posture for sensitive properties. This page covers the allow-list, deletion, and the DPA.

PII allow-list

By default, UserGist removes matching sensitive properties before storage. The default filter covers exact or namespaced contact and identity keys, including:

email, email_address, phone, phone_number, mobile, ssn, tax_id, national_id, passport, common name fields, postal addresses, and birth dates.

If your business legitimately needs one (e.g. email for list exports), open App settings → Privacy and add it to the allow-list.

Privacy settings in app settings.
App settings → Privacy. PII allow-list lives here.

The filter accepts the event or identify call and drops only matching properties that are not on the allow-list. Allow-list entries match the complete property key case-insensitively, including namespaced keys such as user.email.

Deletion (right to be forgotten)

Two paths:

  • Dashboard — Users → search → Delete user.
  • API — POST /v1/apps/:appId/gdpr/delete with a signed-in operator's WorkOS access token and admin role.

Deletion:

  1. Resolves all anonymous aliases linked to the subject.
  2. Removes the subject graph, consent, responses, engagement, and device tokens.
  3. Redacts authored request content while preserving unrelated users' engagement.
  4. Deletes matching analytics data before the job is marked complete.

Submit either an external or anonymous identity:

POST /v1/apps/:appId/gdpr/delete
Authorization: Bearer <workos_access_token>
Content-Type: application/json
 
{ "externalId": "user_42" }

Access (right of access)

POST /v1/apps/:appId/gdpr/export
Authorization: Bearer <workos_access_token>
Content-Type: application/json
 
{ "externalId": "user_42" }

The response returns an exportId. Poll GET /v1/apps/:appId/gdpr/exports/:exportId until the export has completed and the response includes a short-lived download URL.

Data residency

EU (Frankfurt) by default. US is available for Enterprise plans on request.

Encryption

  • In transit — TLS 1.2+ everywhere; the SDKs additionally pin the leaf cert.
  • At rest — AES-256 encrypted via the cloud KMS. Credentials (APNs .p8, FCM JSON) are envelope-encrypted with a per-app key.
  • On device — events, identity, and survey progress live in encrypted storage (Keychain on iOS, EncryptedSharedPreferences on Android, secure-storage backends on RN/Flutter).

DPA & subprocessors

  • DPA available on request — [email protected].
  • Subprocessor list is published at usergist.com/legal/subprocessors. We notify by email 30 days before adding a new subprocessor.

What's next