Security

1. Architectural Overview

The proposed architecture is built on a "Privacy-by-Design" approach. It establishes a European security gateway between the user's terminal and destination platforms (GA4, Meta, etc.).

Logical Data Flow Diagram

[ USER / BROWSER ]
          |
          | (1) HTTPS Flow (First-Party)
          |     Domain: metrics.your-site.com
          v
+-------------------------------------------------------------+
| SECURITY BUFFER ZONE (Bunny.net)                            |
| ----------------------------------------------------------- |
| [ CDN / EDGE ]  <-- SSL Termination & Optimization          |
| [ WAF ]         <-- Filtering (Anti-DDoS, Bad Bots)         |
|                                                             |
| * Config: Global (Performance) OR Tier-1 EU (Sovereignty)   |
+-------------------------------------------------------------+
          |
          | (2) Secured Flow (Encrypted Tunnel)
          |     Protected Origin (Masked IP)
          v
+-------------------------------------------------------------+
| PROCESSING INFRASTRUCTURE (GTM Server-Side)                 |
| ----------------------------------------------------------- |
| Host: SCALEWAY / HETZNER                                    |
| Location: EUROPE (France / Germany)                         |
|                                                             |
| [ GTM LOGIC ]                                               |
| -> Request Reception                                        |
| -> Cleaning / Pseudonymization (IP, User Agent)             |
| -> Enrichment (if required)                                 |
+-------------------------------------------------------------+
          |
          | (3) Server-to-Server API Egress
          |     Controlled & Pseudonymized Data
          +-----------------------+-----------------------+
          |                       |                       |
          v                       v                       v
 [ GOOGLE GA4 ]          [ META CAPI ]          [ OTHER THIRD PARTIES ]
 (United States)         (United States)        (By Vendor)

2. Detailed Flow Analysis

Flow (1): Browser ↔ Bunny.net (Ingress)

• Protocol: Encrypted HTTPS.

• Context: "First-party" collection. The browser communicates directly with metrics.your-site.com, ensuring the flow is treated as internal by the browser and WAF.

• Security: Bunny.net acts as a shield (Reverse Proxy). It absorbs traffic and blocks common threats (injections, botnets) via its WAF before they reach the processing server.

Flow (2): Bunny.net ↔ GTM Servers (Internal)

• Infrastructure: GTM containers are hosted on dedicated instances at Scaleway and Hetzner, which are exclusively European providers.

• Encryption: Data transport is encrypted end-to-end.

• Role: Real-time data processing; no long-term data storage is performed on these servers.

Flow (3): GTM Servers ↔ Partners (Egress)

• Governance: Unlike traditional client-side tracking, your GTM server decides exactly what data is sent based on your specific tag configurations.

• Pseudonymization: Before transmission to GA4 (USA), we remove the real IP address and clean URL parameters (PII) to protect the user's direct identity.

---

3. Data Sovereignty Strategy (Bunny.net)

To meet DPO requirements regarding data localization, we utilize a hybrid strategy:

• Performance Mode: Global CDN configuration for maximum speed.

• Strict Compliance: On-demand activation of the "Tier-1 EU Providers Only" option.

• Impact: Traffic is routed exclusively through nodes located within the European Union, ensuring immediate compliance without service interruption.

---

4. Technical Prerequisites & Impacts

The integration is designed to be "Zero-Trust" compatible and lightweight for IT teams:

• DNS: NS delegation or a simple CNAME record for the sub-domain.

• SSL Certificates: Automated management (provisioning and renewal) handled by Sirdata.

• Firewall / Network: * Update your Content Security Policy (CSP) to whitelist the new sub-domain metrics.your-site.com.

  • No complex port openings required; all traffic uses standard web protocols (Port 443).