Analytics
Consent rates and records
Consent data security
Less data, the same proof.
Kukie.io stores consent records in the European Union, keeps keyed hashes instead of IP addresses and user agents, and deletes each record when your retention period ends.
Why it matters
A consent platform is a privacy decision too.
A consent platform runs on every page, sees every visitor and records each choice. That is a fair trade only if you can say what it holds.
-
Due diligence
The question you will be asked
"Who else sees our visitors?" comes from a client, a procurement team, a new data protection officer or a security questionnaire attached to a contract you want to sign. "It is a cookie banner, it does not collect anything" is not a specific answer.
-
Record keeping
Your record of processing
A record of processing activities asks what data you hold, why, where it sits and how long you keep it. Your consent log is one of those entries, and your consent platform appears by name in the list of processors.
-
Data risk
A privacy log that is a privacy risk
A consent log built without care becomes a table of IP addresses, browser fingerprints and page histories: new personal data whose only job was to show you were careful with personal data.
In the regulation's terms, you are the controller and your consent platform is a processor acting on your instructions. The duty to explain the arrangement stays with you, and this page sets out what Kukie.io holds so the rest is yours to work out.
The consent record
Every field in a consent record.
When a visitor answers your banner, one row is written. The table lists every field in it, and nothing else about that person goes into the record.
| Field | What it contains | Why it is kept |
|---|---|---|
| The choice | Whether the visitor accepted all, rejected all or made their own choice, and which categories they allowed | It is what the log exists to show |
| Consent ID | A random identifier the visitor's browser creates for that choice, also kept in the visitor's consent cookie | Lets one decision be looked up and verified later |
| Date and time | When the banner was answered | Shows the agreement was in place before the cookies were set |
| Visitor ID | A random value the visitor's browser creates and keeps in your website's local storage | Connects a later change of mind to the original decision |
| Country | A 2-letter country code, and nothing narrower | Shows which of your region rules applied |
| IP address, hashed | A keyed one-way hash (HMAC-SHA256). The address itself is never written to the record | Tells one visitor from another without holding the address |
| User agent, hashed | The browser's identification string, hashed the same way | The same reason, and it keeps a fingerprinting surface out of the database |
| Page address | The address of the page the banner was answered on, without its query string | Shows where on your site the choice was made |
| Banner version | A number for the wording and settings in force at the time | Shows what the visitor was shown when they chose |
| Consent Mode state | Where supplied, the Google Consent Mode state the choice produced | Shows what Google's tags were told |
-
Written by the server, never edited
A consent record is written only by Kukie.io's server, from the request the banner sends. Nobody can edit one in the dashboard, including you and including Kukie.io's team: a record can be exported or deleted, and exporting or deleting needs the owner or admin role.
If you do not want records kept for a site at all, consent logging can be switched off for that site. Looking up a record by its consent ID and exporting the log are covered in consent analytics and records.
-
One row, one visitor, one site
Kukie.io does not issue the visitor identifier. It is a random value the visitor's own browser creates and keeps in your website's local storage, so it means nothing anywhere else and does not follow a person from your site to anyone else's.
That is why the consent log answers "did this visitor agree, and to what" and cannot answer "where else has this person been". A consent platform has no business answering the second question.
Kukie.io's technical server logs, which include IP addresses, are typically kept for no longer than 90 days, unless a security investigation or a legal proceeding needs them for longer, as the Privacy Policy sets out.
Hashing
An IP address is hashed, never stored.
It is the decision with the biggest effect on your visitors' privacy, and the one people question most, because storing the address would sometimes be convenient.
A hash is a one-way calculation. The same value always gives the same result, which is what makes it useful, but you cannot run the calculation backwards to recover the original.
Applied to an IP address without a key, that guarantee is weaker than it sounds. There are only about 4 billion IPv4 addresses, and a computer can hash every one of them and build a lookup table. Kukie.io mixes a secret key, held outside the database, into the calculation. Without the key, trying every address gets you nowhere.
The user agent, the text your browser sends to describe itself, gets the same treatment for the same reason. In full it is one of the most useful ingredients in browser fingerprinting, and a consent log never needs it in full.
-
What it costs
You cannot search the log by IP address
If someone gives you an address and asks which consents came from it, no query can answer, and nobody at Kukie.io can answer it either. The same goes for the browser string: you cannot break consent rates down by browser version, because that data is not there.
Those are real capabilities, and giving them up is the price. It is better to name the price than to pretend the choice was free.
-
What it keeps
Everything the log is for
The same input always gives the same output, so records from the same visitor still match each other, duplicates still collapse and a decision can still be shown to have existed at a given moment under a given banner version.
What is gone is the part that identified a person. An IP address is personal data on its own, so a database of them is a liability that grows with your traffic. Keeping less is the most reliable way to lose less.
Hashing makes the record pseudonymous, not anonymous. European supervisory authorities generally treat pseudonymised data as personal data, so your consent log still belongs in your record of processing activities. Hashing lowers the risk. It does not take the log out of scope.
Location and retention
Stored in the EU, deleted on schedule.
Every vendor review asks where consent data lives and how long it stays. Together, the answers cover much of your own paperwork.
-
Data residency
Consent records are stored in the EU
The servers that hold your consent log are in the European Union. Visitors' browsers reach them through Cloudflare's network, and error reports go to Sentry's EU data region. Both companies are based in the US, so the Data Processing Agreement names them with the safeguards that cover them.
A visitor's country comes from the header Cloudflare adds to each request or, failing that, from a geolocation database on Kukie.io's own servers. No IP address is sent to a separate geolocation service. Every sub-processor is in the sub-processor list in section 6.1 of our Privacy Policy.
-
Retention
Records are deleted when their time is up
You set how long consent records are kept for each site in Site Settings, within a maximum that depends on your plan. A scheduled job deletes records once they pass that window, so the platform enforces retention and you do not have to remember it.
A retention limit is usually read as a plan restriction. Read the other way round, it is a data protection control. The pricing page shows the limit of each plan. Choose the shortest period that still covers what you might need to show.
Security measures
What protects the records.
Careful handling of the data is undone by a careless platform around it. These are the measures the Data Processing Agreement commits to, layer by layer.
-
Network
- HTTPS with HSTS
- TLS 1.2 or higher on consent subdomains
- DDoS protection at Cloudflare's edge
Every request travels over HTTPS. Cloudflare's network absorbs floods and serves each site's banner script from the edge.
-
Application
- Rate limits per site, visitor and IP
- Sanitised HTML and CSS
- Content Security Policy
- CSRF protection
The consent endpoint has to be open to browsers, so rate limits keep invented records out of your log. Code you paste is cleaned when saved, but a script tag still runs as pasted, so paste only code you trust.
-
Account
- Two-factor authentication
- Breached-password check
- bcrypt password hashes
- 120-minute idle sessions
- Owner, admin and editor roles
Two-factor authentication is available to every account, with recovery codes. Exporting or deleting consent records needs the owner or admin role.
-
Records
- Written only by the server
- Never editable
- Keyed hashes for IP and user agent
- Tenant separation checked on every request
A consent record can be exported or deleted, never changed. Every organisation's data is kept apart, and that separation is covered by automated tests.
-
Behind it
- Backups every 6 hours, 30 days
- Retrying consent queue
- Releases that can be rolled back
- Internal audit log
- Tests before every deployment
The audit log records sign-ins, administrative actions, deletions of consent records, exports of one visitor's records and the start of every support session. It is Kukie.io's own record, not a dashboard feature.
The full list is Annex II of the Data Processing Agreement. Turn two-factor authentication on: it is not forced on any account, and the sign-in is where one reused password would put every consent record you hold behind a single guess.
Certifications
No certification badges on this page.
You have seen the strip: a line of logos, a shield, a percentage. We have left it out, because we would have to put something there we cannot stand behind.
What we can show you is the design, and the design is this page. You can hold us to each point and quote it in your own documentation.
If your procurement process needs a specific document before you sign, ask at the start, not after you have moved your sites. The Data Processing Agreement is already published, so that one needs no request. A straight answer about what exists is more useful than a badge, and quicker to get.
What you can hold us to
- Every field in a consent record, listed on this page
- IP addresses and user agents hashed with a secret key
- Consent records stored in the European Union
- Retention enforced by a scheduled job
- A published Data Processing Agreement
Who asks
Who ends up needing these answers.
Most site owners never think about where their consent log lives, and for a small site that is reasonable. These are the situations where someone asks.
-
Agencies and freelancers
It is not your data to be casual with
Choosing a consent tool for a client means choosing a sub-processor on their behalf, and they may have to name it. Handing over one page is quicker than writing an email per client.
Managing the sites themselves is covered on the agencies and teams page.
-
Selling to larger organisations
The questionnaire arrives eventually
Vendor security reviews ask about every third party with access to customer data, and a consent banner qualifies. "Stored in the EU, IP addresses hashed, retention enforced" answers 3 questions on that form in one sentence.
-
Sensitive sectors
Where the visitor list itself is revealing
On a health site, a legal advice site, a charity or a public body, the fact that someone visited at all can be the sensitive part. Not holding an address or a browser fingerprint against each visit matters most here.
-
Anyone writing the paperwork
You cannot document what you cannot see
A record of processing activities needs categories of data, purposes, locations and retention periods for each processor. The table on this page is the consent log entry, close to ready to copy across.
Questions about consent data
Where is cookie consent data stored?
In the European Union. Consent records collected through Kukie.io are stored on servers in the EU. Two sub-processors that handle visitor data are US companies: Cloudflare, Inc., whose network carries requests to the banner and the consent endpoint, and Functional Software, Inc. (Sentry), which receives error reports in its EU data region. The Data Processing Agreement names both with the safeguards that cover them, and the full sub-processor list is in the Privacy Policy.
Is cookie consent data personal data?
Treat it as personal data. A consent record holds no name and no email address, and the IP address and user agent are hashed rather than stored, but the record is still tied to a pseudonymous identifier for one visitor. Pseudonymised is not the same as anonymous, and European supervisory authorities generally treat pseudonymised records as personal data. In practice, your consent log belongs in your record of processing activities like any other personal data.
Why does Kukie.io hash IP addresses instead of storing them?
Because the log exists to show that a choice was made and respected, not to identify the person who made it. An IP address is personal data in its own right, so keeping one would make every consent record an identifiable record about an individual. Hashing keeps what the log is for, telling one visitor from another and showing that a decision existed at a point in time, and removes the part you would rather not hold.
Can a hashed IP address be turned back into an IP address?
Not from the stored value on its own. A plain hash of an IP address would be weak, because there are only about 4 billion IPv4 addresses and a computer can work through all of them. Kukie.io mixes in a secret key held outside the database, so nobody can match the stored value back to an address by trying every possibility. The result is still stable, which is why the same visitor keeps producing the same value.
How long is cookie consent data kept?
For as long as you choose for each site, within a maximum that depends on your plan. A scheduled job deletes consent records once they pass the retention period set for the site, so the platform enforces deletion and you do not have to remember it. The pricing page shows the retention limit of each plan.
Is Kukie.io a data controller or a data processor?
For the consent data collected from your website visitors, Kukie.io is a processor and you are the controller. You decide what to ask your visitors, which categories exist on your site and how long the answers are kept, and Kukie.io stores and processes that data on your instructions. The distinction matters when you write your privacy policy and your record of processing activities, because it decides which obligations fall on you and which fall on Kukie.io. One of Kukie.io's obligations: a breach that affects your visitors' data is reported to the owner of your account by email within 72 hours of Kukie.io becoming aware of it, as the Data Processing Agreement sets out.
Collect consent without collecting your visitors.
Hashed identifiers, EU storage and enforced retention come with every plan, including Free.
Related features
What Kukie.io does with the records it keeps, who in your organisation can reach them and how the banner works for every visitor.
-
-
Agencies and teams
Many sites, scoped access
-
Accessibility
Designed against WCAG 2.2 AA
More on consent data and your obligations
Background reading on processors, processing records and moving personal data across borders.
-
Records of Processing Activities: The GDPR Compliance Checklist You're Probably Missing
A Record of Processing Activities (ROPA) is the document most organisations need under GDPR Article 30 but few get right. The Irish DPC's 20...
-
Data Processors vs Data Controllers: Understanding Your Role Under GDPR
Every organisation handling personal data under the GDPR acts as either a controller or a processor. Learn how this legal distinction dictat...
-
How to Create a Data Processing Agreement (DPA) for Your Website Vendors
Every website that shares visitor data with third-party services needs a data processing agreement in place. This guide walks through the ma...
-
Cross-border data transfers under GDPR and the adequacy list
As of October 2026, 17 European Commission adequacy decisions let personal data leave the EEA without extra safeguards, the newest for Brazi...
Disclaimer
Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.
