How this works in production

A practical guide for moving from this local proving ground to a hosted, governed measurement service.

The short version

A website collector sends a small POST to this service. The service removes sensitive values, matches the observation to an approved canonical event, checks consent and routing, then sends only the approved safe payload to each enabled destination. The browser never holds destination secrets.

One event's journey

1. CollectSite or GTM collector sends a sanitised observation to /collect.
2. GovernPrivacy filtering and mapping turn it into a canonical event.
3. Policy checkApproval, consent category, and destination routing are evaluated.
4. DeliverServer-side adapters POST safe payloads and record the result.

What the website sends

The collector sends an observation to your hosted service, not directly to analytics vendors.

POST https://analytics.example.com/collect
Content-Type: application/json

{
  "event_name": "component_interaction",
  "page": {"path": "/account-opening/personal-details"},
  "details": {
    "element": {
      "analytics_id": "account-opening:continue",
      "element": "button",
      "text": "Continue"
    }
  }
}

Never included: typed input values, email addresses, phone numbers, account numbers, passwords, or raw query strings by default.

What the service does

  1. Accepts and size-checks the event at /collect.
  2. Normalises routes and redacts blocked keys and detected PII.
  3. Stores sanitised raw evidence for controlled reprocessing.
  4. Applies a deterministic approved mapping from the Event Catalog.
  5. Checks readiness and the destination's consent category.
  6. POSTs only the destination-specific safe payload from the server.

What each destination receives

The canonical event is adapted per connector. A destination can be configured without being live.

Configure destinations Preview payloads

Choose what fires where

Open Event catalog and switch a destination On or Off for each governed event. The choice is saved as an activation rule and is checked before a live POST is made.

  • Server destinations: Matomo, Webhook, and Warehouse only receive selected, ready events.
  • Preview destinations: GA4, Optimizely, Google Ads, and LinkedIn Ads show the payload shape until their live adapters are implemented.
  • Browser tags: use Tag registry to select which canonical events activate each registered script or pixel.

Local test to production

  1. Use Test lab to generate known interactions.
  2. Use Observe to process, inspect and preview them.
  3. Create or edit the governed rule in Catalog.
  4. Test a destination with a non-production endpoint or test property.
  5. Publish the reviewed configuration in Releases.
  6. Deploy the exported GTM tag to the relevant test domain.
  7. Promote the hosted service and configuration through Development, Test, then Production.
  8. Watch Monitoring before enabling broader routing.

Production boundary

This repository is a local prototype. Production requires a hosted API, authentication, encrypted secret storage, a managed database/queue, real consent-platform integration, per-environment configuration, access control, alerting, backups, retention/deletion controls, and a deployment process. The current local consent switches and JSONL warehouse export are test mechanisms, not production controls.