Security you can check, in plain words.

The database runs in Frankfurt (eu-central-1) and the app's servers run in the same region. The providers we rely on are listed in our privacy policy.

Every table uses row-level security in the database. An automated test signs in as a stranger and tries to read, change and delete another company's data across every workspace table and function, and a check fails if a new table isn't covered.

• Every connection is encrypted with HTTPS, and browsers are told to always use it (HSTS).
• Tokens for connected tools such as HubSpot are encrypted before they're stored.
• The app and sign-in can't be framed by other sites, which stops clickjacking.
• No secret keys are ever sent to the browser.
• Uploads are checked by their content, and scriptable files are refused.

• Sign in with an e-mail link or a passkey — there's no password to reuse or leak.
• See your signed-in devices and sign any of them out.
• Owner, admin, editor, viewer and client roles, enforced on the server and in the database.
• Approval before an editor's page, form or destination change goes live.
• API keys limited to the resources they need, with lockout after repeated wrong keys.
• Signed webhooks, with secret rotation that keeps both signatures valid for 24 hours.

• Destinations are checked when they're created, when they're edited and again on a schedule.
• Checks use Google Safe Browsing, open threat feeds, and rules for lookalike domains, hidden credentials, punycode and direct downloads.
• Redirect loops back to our own short links are refused.
• Unsafe destinations are blocked with a warning page, and the owner is told why.
• Every public page has “Report this page”. Reports are reviewed by our team, and confirmed abuse is taken offline.
• Anyone can check a link before opening it with our free QR code safety checker.

• A public status page checks the service every five minutes and keeps 90 days of history.
• If the database has a short outage, recently scanned codes keep redirecting from a cached copy.
• Export your redirect table at any time — enough to rebuild every printed code's redirect elsewhere.

Card payments are processed by Stripe. QRiva never sees or stores your card number.

Please tell us privately through Support, choosing “Something's broken”, and start the subject with “Security”. Give us reasonable time to fix it before sharing details, and don't access or change other people's data. We won't take action against research done in good faith.