Email tracking has a real privacy footprint, and the privacy posture of the tracking tool is one of the things a sales-leader should actually understand before rolling it out across a team. This piece is the practical version of the privacy question: what tracking pixels actually do, what each tool stores, what compliance frameworks matter, and how to answer the procurement question when it shows up.
What a tracking pixel actually does
A tracking pixel is a 1x1 transparent image embedded in the email. When the recipient's mail client renders the message, it loads the image from the tracker's server. The server logs the request: which message, which recipient, the time, the IP address, the User-Agent. That is the entire mechanism.
The pixel is not invisible to a determined recipient. Any recipient who inspects the email source can see the image-tag pointing at a tracker domain. Any recipient using a mail app that blocks remote images (or Apple Mail Privacy Protection, which pre-fetches every image on Apple servers) breaks the standard tracking signal. There is no version of tracking that is undetectable to a privacy-aware user.
This is a feature, not a bug. The pixel mechanism is standard practice in B2B sales, has been for over a decade, and has the same legal posture as any other engagement-tracking technology. The question is not whether tracking is legal (it is, in nearly every jurisdiction, with caveats below), it is what data the tracking tool retains and how it is protected.
Metadata vs body: the structural choice
Tracking tools split into two architectural categories.
Metadata-only. The tool stores engagement events (open timestamps, click events, IP and User-Agent for confidence scoring, reply detection signals) and the subject line. It does not store the body of the email. Outsolvi's tracking is in this category; its follow-ups store the text they send, and a connected mailbox syncs replies.
Body-reading. The tool stores the full body of the email because its product features (sequences, templates, mail merge, CRM features) require the content. Yesware, Saleshandy, HubSpot Sales Hub, Streak, Mailbutler, and most CRM-with-tracking tools are in this category.
The trade-off is feature breadth versus stored surface area. A body-reading tool can offer content-aware AI features and full thread search across everything you send. A tool with metadata-only tracking can still send follow-up sequences, but it has to store the follow-ups it sends; the procurement conversation about tracking itself is meaningfully simpler. For sales into regulated industries (healthcare, financial services, legal, government), the metadata-only choice is often the deciding factor.
Encryption posture
The encryption-in-transit and encryption-at-rest standards in 2026 are well-established. Any serious tracking tool should be at or above the following baseline.
- In transit: TLS 1.3 (TLS 1.2 minimum) for every request between the tracker, the email client, the recipient's mail server, and any CRM webhook receiver.
- At rest: AES-256 encryption for stored data. Key derivation via scrypt or Argon2 for any user-credential or sensitive-data handling.
- Database-level encryption: Encrypted database volumes and field-level encryption on any retained metadata that could be considered sensitive.
Outsolvi's database is encrypted at rest with AES-256. On top of that, tracked subject lines, mail synced from a connected mailbox and mailbox access tokens get field-level AES-256-GCM encryption with a scrypt-derived key. Passwords and API keys are hashed with bcrypt, and traffic uses TLS 1.2 or 1.3. Recipient email addresses are not field-encrypted.
Ask the vendor specifically about field-level encryption, not just disk encryption. Disk encryption is table stakes (the cloud provider does it by default). Field-level encryption protects individual rows in case of a database compromise where the attacker has read access to the underlying storage.
Compliance frameworks that actually matter
Three frameworks come up in procurement reviews in 2026. The relevance depends on where your buyers are.
GDPR (EU + UK). Applies if any of your prospects are in the EU or UK, which is most B2B teams. The relevant articles for tracking are Article 6 (lawful basis for processing) and Article 7 (consent). The dominant interpretation in B2B sales is that legitimate-interest processing is lawful for direct outreach to business contacts, provided the recipient can opt out and the data retention is proportionate. Tracking falls under this. The tool should provide a data-processing agreement (DPA), a record of processing, and the ability to honour right-to-erasure requests on retained metadata.
CCPA + CPRA (California). Applies if any of your prospects are in California. The relevant provision is the right to know what data is collected and the right to delete. The tool should provide the same DPA-equivalent and erasure capability as for GDPR.
SOC 2. Not a regulation; an audited security-controls framework. SOC 2 Type II reports are the standard request from mid-market and enterprise procurement teams. A tracker without SOC 2 Type II is harder to clear in those reviews, regardless of how well-built the actual security posture is.
Outsolvi supports GDPR and CCPA requests for export and deletion, and its security controls follow SOC 2 criteria. It has not had a SOC 2 audit, so there is no SOC 2 report to send. If your buyers require one, that matters, and it's better to know before you roll a tool out than in the middle of a review.
The "are you reading my emails" question
This question shows up in two contexts: the IT or legal team during procurement, and a curious or privacy-aware prospect who notices the tracking pixel.
For procurement, the answer for Outsolvi's tracking is no. Tracking stores metadata (open timestamps, click events, subject lines, engagement signals) and never the body of the tracked email. Follow-ups Outsolvi sends, and replies synced from a connected mailbox, are the exception, stored encrypted at rest. The technical mechanism: the Outsolvi extension or add-in reads the subject and recipient list to inject the tracking pixel, but does not exfiltrate the body to Outsolvi servers.
For body-reading trackers (Yesware, Saleshandy, HubSpot Sales Hub, Streak, Mailbutler), the answer is yes: the tool stores the body because product features require it. This is not inherently bad; it is a different posture with different compliance implications. The procurement-team-friendly version of the answer is to explain why (sequencing, templates, CRM integration) and show the encryption posture protecting the stored data.
For prospects who notice the pixel, the honest answer is "yes, this is standard B2B sales tracking, you can ignore the pixel or your mail client will pre-fetch it without you doing anything." Most B2B buyers know this and do not raise it as an objection; the small share who do raise it value transparency and tend to react worse to evasive answers.
CAN-SPAM and unsubscribe handling
CAN-SPAM (US) and similar laws elsewhere require that commercial email include a clear opt-out mechanism and that opt-outs be honoured within 10 business days. The applicability to one-to-one B2B sales email is fuzzy (most jurisdictions exempt purely transactional or relationship-based outreach from bulk-email rules), but the safest posture is to include an opt-out link on any tracked outbound that is not part of an existing reply thread.
Tracking tools should either inject the opt-out automatically or make it easy to include manually. The opt-out should write to a suppression list that prevents future tracked sends to that recipient.
What to put in the security review packet
When a buyer asks for the security review, the packet that clears most procurement reviews in 2026 includes:
- Encryption posture (TLS version in transit, AES-256 at rest, how keys and passwords are handled)
- Data-handling architecture (metadata-only vs body-reading, what is stored and where)
- SOC 2 Type II report (or alternative independent audit)
- GDPR DPA and record of processing
- CCPA + CPRA compliance statement
- Sub-processor list (cloud providers, AI providers, analytics)
- Right-to-erasure and data-portability process
- Incident-response and breach-notification policy
- Penetration test summary (annual is standard)
Most teams do not need to assemble this from scratch; the tracking-tool vendor should have it ready as a downloadable packet. If the vendor cannot produce this packet in 48 hours of asking, that itself is a signal about the security posture. For the record, Outsolvi can't hand over all nine today: it has no SOC 2 report and no third-party penetration test yet. Ask for the rest and we'll tell you plainly what exists.
The honest read
Privacy posture is one of the easier things to get right on a tracking tool, and one of the most over-engineered topics in vendor pitches. Metadata-only tracking (no body stored for tracked emails) eliminates roughly half the procurement-friction surface. Encryption in transit and at rest is table stakes; a SOC 2 Type II report is what larger buyers expect on top.
Outsolvi's tracking is metadata-only. Everything it stores, follow-ups and synced replies included, is encrypted at rest with AES-256 and in transit with TLS 1.2 or 1.3, and synced mail gets field-level encryption on top. What it doesn't have yet is a SOC 2 audit or a third-party penetration test. The detailed comparison of each tracker's privacy posture against Outsolvi lives on the comparison pages. For teams selling into regulated industries, this is often the deciding factor between trackers; for teams selling into less-regulated buyers it is a secondary consideration to the tracking accuracy itself.
The 14-day Outsolvi trial needs no card and no procurement paperwork, and it runs against your real sends.