PostHog
The PostHog app enables users to subscribe to insights and dashboard about user behavior. Existing PostHog users can subscribe to existing or new insights on a daily, weekly or monthly basis, to any specific channel in their Workspace.You can also setup Slack notifications via our Data Pipelines to get timely notifications of any event or action in PostHog.
Permissions
PostHog will be able to view:
PostHog will be able to do:
Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.
General
Developer
PostHog Inc.
Company headquarters location
United States
Terms of service
Privacy & data governance
Data retention policy
Customer data is retained for as long as the account is in active status. Data enters an “expired” state when the account is voluntarily closed. Expired account data will be retained for up to 90 days, plus any relevant backup period. After this period, the account and related data will be removed. Customers that wish to voluntarily close their account should download their data manually or via the API prior to closing their account.
If a customer account is involuntarily suspended, then there is a 30 day grace period during which the account will be inaccessible but can be reopened if the customer meets their payment obligations and resolves any terms of service violations.
If a customer wishes to manually backup their data in a suspended account, then they must ensure that their account is brought back to good standing so that the user interface will be available for their use. After 30 days, the suspended account will be closed and the data will enter the “expired” state. It will be permanently removed up to 60 days thereafter, plus any relevant backup period (except when required by law to retain).
Data archiving and removal policy
Customer data is retained for as long as the account is in active status. Data enters an “expired” state when the account is voluntarily closed. Expired account data will be retained for up to 90 days, plus any relevant backup period. After this period, the account and related data will be removed. Customers that wish to voluntarily close their account should download their data manually or via the API prior to closing their account.
If a customer account is involuntarily suspended, then there is a 30 day grace period during which the account will be inaccessible but can be reopened if the customer meets their payment obligations and resolves any terms of service violations.
If a customer wishes to manually backup their data in a suspended account, then they must ensure that their account is brought back to good standing so that the user interface will be available for their use. After 30 days, the suspended account will be closed and the data will enter the “expired” state. It will be permanently removed up to 60 days thereafter, plus any relevant backup period (except when required by law to retain).
Data storage policy
PostHog policy requires that:
Data must be handled and protected according to its classification requirements and following approved encryption standards, if
applicable.
Whenever possible, store data of the same classification in a given data repository and avoid mixing sensitive and non-sensitive data in
the same repository. Security controls, including authentication, authorization, data encryption, and auditing, should be applied according
to the highest classification of data in a given repository.
Employees shall not have direct administrative access to production data during normal business operations besides in the course of
providing standard customer support. Exceptions include emergency operations such as forensic analysis and manual disaster recovery.
All Production Systems must disable services that are not required to achieve the business purpose or function of the system.
All access to Production Systems must be logged.
All Production Systems must have security monitoring enabled, including activity and file integrity monitoring, vulnerability scanning,
and/or malware detection, as applicable
Data center location(s)
United States, Germany
Data hosting company
AWS
App/service has sub-processors
no
App/service uses large language models (LLM)
no
Certifications & compliance
SOC attestation
Data deletion request procedure
Customers contact our free support channel with request for deletion, we verify their identity and will delete it as soon as practicable and respond to the user.
HIPAA compliant
yes
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.
Security
Date of latest pen test
2024-04-18
Executive summary is available to potential customers upon request
yes
Supports Single Sign On (SSO) with the following providers
Google, Github, Gitlab, SAML
Supports Security Assertion Markup Language (SAML)
yes
Has a dedicated security team
no
Contact for security issues
support@posthog.com
Has a vulnerability disclosure program
no
Has a bug bounty program
no
Requires third party authorization/connections
no
Uses token rotation
no