This week on Spectry: three security improvements with zero customer disruption.

Spectry, the AI platform for website insights, analytics, A/B testing, and session replay, is now in open beta. These first weeks since launch have been the right time to focus on foundational security work for early users already trusting the product.

Two-factor authentication
All Spectry accounts now support authenticator apps including Google Authenticator, 1Password, and Authy. Login requires a time-based six digit code in addition to a password. At setup, users receive ten one-time backup codes to ensure account recovery if a device is lost. If both primary and backup access are unavailable, a controlled recovery process is available. Every recovery action is fully logged and triggers an email notification to the account owner. Security and accountability are built into the process by design.

Per-site privacy mode
Organizations operating under different regulatory environments can now configure privacy behavior per site. Spectry supports strict consent enforcement as the default for GDPR aligned use cases, as well as an implicit consent mode for US based or B2B contexts where banner based consent is not required. The setting is clearly presented in the dashboard in plain language.

Signed install codes
Every site now receives a private signature embedded in its tracking snippet. The backend validates this signature on every incoming event. This prevents unauthorized event spoofing, even if a public site identifier is exposed. External systems cannot submit fraudulent analytics events into a project.

The rollout approach required careful consideration. The simplest option would have been to enable signature validation globally and announce the change. However, existing beta installations do not include signed snippets. Enabling strict enforcement immediately would have broken active customer setups.

Instead, enforcement remains gradual. New installations are signed by default. Existing beta installations continue to operate without disruption. The system is being monitored until signed traffic represents the vast majority of events, at which point strict validation will be enabled. From the outside, nothing changes until protections quietly become stronger.

This approach prioritizes stability for early users while steadily increasing security in production.

Open beta is live. Sign up at https://spectry.io/beta