How do you ensure data security and compliance?
We secure what we build and connect your cookie consent tool to your tags, then test it. Where your domain is on Cloudflare, we use it for SSL, caching and protection against attacks, and we add spam checks to forms that attract junk and logins in front of private pages such as staging. We don't give legal advice or promise compliance, so a qualified person needs to sign off your policy.
Security
- SSL, caching and protection against attacks: through Cloudflare, where your domain is on it.
- Private pages: our own staging and internal tools sit behind a Cloudflare Access login.
- Forms: Cloudflare Turnstile checks form fills on our own site, and we've used Webflow's Turnstile bot blocking on a Webflow form that was getting spam.
Privacy and consent
We connect your cookie consent tool to Google Tag Manager so tags follow the visitor's choice, and we test it. How that is built depends on the project. With Stape you choose what each platform receives. On health sites, the lead event carries only an ID and a click ID, never a name, email or phone number.
Who signs it off
Your privacy policy and your lawful basis for collecting data are decisions for you and a qualified adviser, because we don't give legal advice or promise compliance. We build the technical side to match them. See our tracking and infrastructure service.
The tools in this answer
CloudflareSits in front of our sites and tools: DNS and caching, Workers, R2 storage, Access, Turnstile and Pages.Tech
GTMHolds every tag, in the browser and on the server, so a change goes in once and gets tested before it goes live.Tech
StapeStape runs the server side of our tracking. Tags load from the client's own domain, and the server passes each conversion on to GA4, Google Ads and Meta, so fewer get lost to ad blockers and Safari.Tech
Where this came up in our work
- Client work
The Therapy Lounge
70% more enquiries, 6.6x return on ad spend in October 2025, and 316 enquiries tracked from April 2025 to October 2026.
Read the story - Client work
Sector7
An award-winning rebuild, 177% more new users in 2025 than 2024, and Jon calls it "executed flawlessly, on time and on budget".
Read the story
Also worth asking
Other answers about the same tools.
What is technical and tracking infrastructure?
It's the set-up that counts what happens on your site and sends it where it needs to go: tracking tags, analytics, ad-platform conversions, your CRM connection and cookie consent, plus the hosting and security around your website.
How do you set up website analytics and tracking?
We agree with you what counts as a conversion, then set up Google Tag Manager and GA4, plus server-side tracking through Stape for sites that spend on ads. Before we hand over, we check the data is actually arriving.
What is server-side tracking, and why do we use Stape?
Server-side tracking means your site sends each event once, to a server container, and that server passes it on to GA4, Google Ads and Meta, instead of every platform running its own script in the visitor's browser. We use Stape to host that container so you don't have to run a server. It reduces lost conversions. It doesn't get them all back, and it doesn't get round consent.
How do you handle compliance management for my website?
We work with your cookie consent tool, or suggest one we've worked with, and connect it to your tags so they follow the visitor's choice. How that's wired depends on the project, so we test what your tags actually do. We don't write legal text or give legal advice, so your privacy policy needs sign-off from someone qualified.
What is ad platform integration and why does it matter?
Ad platform integration means joining your website, tracking and CRM to the ad platforms, so they receive the leads and sales that came from their ads. Without it, bidding learns from clicks and form fills instead of customers.
Still have questions?Talk to us
Bring your numbers.
We'll tell you if the spend makes sense.
- A 15-minute callYour goals, your challenges, and whether we're the right fit.
- A 1-hour discovery callWe dig into your numbers. Worth a hundred emails.
- A concrete planAds, a custom build or both, as a one-off project or ongoing.