Where WhoLayer's data comes from, and how accurate it is

Sources

• Licensed data suppliers and consent-aware publisher networks. Every supplier signs a written promise about how its data was collected.
• Never logged-in scraping, fake accounts, or LinkedIn scraping.
• Your own site's visitors are used to identify people for you. We don't add your visitors' browsing to a shared graph other customers can query.

How we measure accuracy

• We keep a holdout set of real visits where the visitor's identity is already known (for example, people who later filled in a form), from customers who opt in to benchmarking.
• We run those visits through WhoLayer blind, then report two numbers: the match rate (how often we returned a person) and the accuracy (how often that person was right), broken out by B2B vs ecommerce and by device.
• The first report publishes after 90 days of operation. Until then we don't quote a match rate we haven't measured. See the Trust page.

Security

• TLS in transit, AES-256 at rest, hashed identifiers for suppression, SSO and MFA on all production access.
• SOC 2 Type II audit in progress. Customers can request our security questionnaire, a signed DPA, or the supplier list under NDA at security@wholayer.com.

Where we never operate

Sites or pages about health, sexual health, religion, sexual orientation, immigration, or financial hardship, and sites for children. We never sell precise location.