Everything on your server
One Node process with SQLite that you run yourself. Visitor data never leaves your network, because it is never sent anywhere.
Privacy & compliance
A/B testing without data
going to third parties.
abdriven runs on your own server. Visitor data goes to nobody.
- Self-hosted, no vendor in between
- No IP addresses, no profiles
- Consent as a technical switch
The difference
How abdriven protects
your visitors’ data.
The snippet, the analysis and the database sit on your infrastructure. Nothing goes to a third party.
Delivered from your own domain
The snippet loads from a subdomain of your website, for example t.your-domain.com. To the browser that is not a third-party request.
No IP addresses
abdriven stores no IP addresses, no names, no e-mail addresses, and links nothing across websites.
Consent that actually takes effect
With data-consent="required" nothing happens before consent: no identifier, no event, no request.
Aggregated results only
Analyses, reports and exports contain totals and rates, no individual visitors, no event log.
A revocation that cleans up
abdriven.revoke() stops measurement, removes applied changes and clears this website’s local visitor data.
To be precise
What abdriven stores
and what it does not.
A test only needs to remember one thing: which variation this browser saw. Otherwise the same visitor sees something different on the next click.
- Stored: an anonymous identifier created in the browser, the assignment to a variation, and aggregated counters.
- The assignment itself is a salted hash of experiment and identifier, no visitor can be reconstructed from the database.
- Not stored: IP address, plain user agent, form contents, page contents, mouse movements.
- Segments (device, source, new versus returning) are recorded once at first contact, with no identifier alongside.
- Browsers without usable local storage are not enrolled at all.
Inside the company
Security and
traceability.
Access, keys and changes are traceable, not because it sounds good, but because an audit asks for it.
- Activity log: who started, paused or reconfigured which experiment, and when.
- Roles per level, agency, client, website, with read-only access for everyone who only needs results.
- API tokens are limited to websites, expire after 30, 90 or 365 days, and are stored only as a SHA-256 hash.
- Shared report links expire, can be revoked individually, and are likewise stored only as a hash.
- Passwords as salted scrypt hashes, sessions as HttpOnly cookies, additionally Secure over HTTPS.
FAQ
Privacy & compliance
Do I need cookie consent for A/B tests?
That depends on your setup. With data-consent="required" abdriven waits until your consent manager agrees. Or you load the snippet only after consent.
Where is the data?
Wherever you run abdriven. There is no transfer to us, because the software runs on your server and its database lives there.
Can I switch abdriven off in sensitive areas?
Yes. Experiments only run on the page paths you allow. Customer accounts, checkout or internal areas stay out of it as long as you do not target them.
What happens when a visitor withdraws consent?
abdriven.revoke() stops measurement, undoes changes and clears the data in the browser. Anonymous totals remain, they belong to no visitor.
Product