Overview
The PostHog integration monitors your product analytics setup: projects, team members, feature flags, dashboards, cohorts, and actions. LowerPlane uses read-only access via the PostHog API to verify data privacy controls and access management.Prerequisites
How to Get Your API Key
Log in to PostHog
Log in to app.posthog.com (or your self-hosted PostHog instance).
Open Personal API Keys
Click your profile icon in the bottom-left, then go to Settings > Personal API Keys.
Create a new key
Click Create Personal API Key. Give it a descriptive label like “LowerPlane Compliance”.The personal API key provides read access to all organization and project data your account can access.
Connecting in LowerPlane
- Go to Settings > Integrations in LowerPlane
- Find PostHog under Analytics
- Enter your API Key (Personal API key)
- Enter your API URL:
- PostHog Cloud US —
https://app.posthog.com - PostHog Cloud EU —
https://eu.posthog.com - Self-hosted — your PostHog instance URL (e.g.,
https://posthog.yourcompany.com)
- PostHog Cloud US —
- Click Connect
What LowerPlane Collects
Organization & Projects
Organization details and all projects with their API keys, recording settings, and data retention configuration.
Team Members
All organization members with roles, email, and access levels. Members are matched to your LowerPlane people directory.
Feature Flags
All feature flags with their status (active/inactive), rollout percentage, and targeting rules.
Dashboards
Dashboard inventory showing who has access to analytics data.
Cohorts
User cohorts and their definitions, relevant for data privacy reviews.
Actions
Tracked actions and events, showing what user behavior data is being collected.
Compliance Mapping
| Framework | Controls | What It Proves |
|---|---|---|
| SOC 2 | CC6.1, CC7.2 | Access controls and monitoring are configured for analytics data |
| ISO 27001 | A.8.11, A.8.12 | Data masking and privacy controls for user analytics |
| GDPR | Art. 25, Art. 30 | Data protection by design and records of processing activities |
FAQ
Does LowerPlane access any user analytics data?
Does LowerPlane access any user analytics data?
No. LowerPlane only reads project metadata, team members, feature flags, and configuration. It does not access individual user events, session recordings, or analytics data.
Can I connect self-hosted PostHog?
Can I connect self-hosted PostHog?
Yes. Enter your self-hosted PostHog instance URL (e.g.,
https://posthog.yourcompany.com) as the API URL when connecting. The personal API key works the same way for both cloud and self-hosted instances.How often does LowerPlane sync?
How often does LowerPlane sync?
PostHog data syncs every 24 hours by default. You can trigger a manual sync from the integration settings.
Why is PostHog relevant for compliance?
Why is PostHog relevant for compliance?
PostHog collects user behavior data which falls under GDPR, HIPAA, and SOC 2 data protection requirements. LowerPlane verifies that your PostHog setup has proper access controls, data retention policies, and privacy configurations in place.