Trust
Security at OneClickTag
Last updated Oct 21, 2026
We ask Google only for what building your tracking needs, we never touch campaigns or budgets, and you can cut our access at any time.
Where your data lives
OneClickTag runs on Google Cloud in the europe-west3 region (Frankfurt, Germany). The app, the database (Cloud SQL for PostgreSQL) and uploaded files (Cloud Storage) all live there.
- Every connection to oneclicktag.com uses HTTPS. Plain HTTP is redirected.
- Everything we store is encrypted at rest by Google Cloud.
- Secrets such as API keys live in Google Secret Manager, not in code.
Google access: what we ask for and why
When you connect a client Google account, Google shows you this list and you approve it. We ask only for what building and checking tracking needs.
| Permission | What OneClickTag does with it |
|---|---|
| See your email address and basic profile | Show which Google account a client is connected through |
| tagmanager.manage.accounts | Find your Tag Manager accounts |
| tagmanager.edit.containers | Create tags and triggers in Tag Manager |
| tagmanager.edit.containerversions | Save Tag Manager versions (needed to publish) |
| tagmanager.delete.containers | Clean up Tag Manager containers it created |
| tagmanager.publish | Publish Tag Manager changes |
| adwords | Create Google Ads conversions |
| analytics.edit | Set up Google Analytics properties and streams |
| analytics.readonly | Read Google Analytics properties |
What we never do:
- We never change campaigns, budgets, bids, ads or audiences in Google Ads. The only things we create there are conversion actions and their labels.
- Nothing goes live in a client Tag Manager container until you publish it, or until you turn on auto-publish for that client yourself. Auto-publish is off by default.
- All our Tag Manager work happens in a separate "OneClickTag" workspace, so it never mixes with changes someone else is drafting.
How we hold Google access
- Google access tokens are stored in our database in Frankfurt and are used only by our own services.
- Disconnecting a Google account in OneClickTag revokes our access at Google and deletes the stored tokens.
- You can also remove our access at any time from your Google account at myaccount.google.com/permissions. OneClickTag then shows that client as needing to reconnect, instead of pretending things still work.
Signing in
Sign-in is handled by Firebase Authentication from Google. Your password goes to Firebase, never to our own servers. You can also sign in with Google.
Keeping agencies apart
Every client, tracking and scan belongs to one agency workspace. Every request is checked against the signed-in workspace before anything is read or changed, so one agency can never see another agency's clients.
What a scan reads
- Scans visit the public pages of a client site, the same pages any visitor sees. By default, scans don't log in to client sites.
- We keep what we need to recommend and check tracking: page addresses, the buttons and forms we found, and test results.
- To understand a page, we send its content to Google Gemini through Vertex AI in our own Google Cloud project. Under Google Cloud terms, that content is not used to train Google's models.
- If you save a website login for a client, we encrypt the password with AES-256-GCM before storing it, and the app never shows it again.
Services we use
| Service | What for | What it receives |
|---|---|---|
| Google Cloud | Hosting, database, file storage, AI page analysis (Vertex AI), sign-in (Firebase) | Account details, client data, Google access tokens, scanned page content |
| Polar | Payments and subscriptions | Billing name and email. Card details are entered at Polar, and we never see them |
| ZenRows | Fetching pages of sites that block automated visits | The address of the public page being fetched |
| Google Workspace | Sending email | Your email address and the message |
Reporting a security issue
Found something? Email support@oneclicktag.com with "Security" in the subject. A person reads it, and we reply within one business day.
Every conversion.
Verified.
Add your first client in two minutes. We’ll tell you what to track.