Security Whitepaper

TLS 1.3

All API traffic and SDK data transfers are encrypted with TLS 1.3. Anything below TLS 1.2 is rejected.

HTTPS Enforced

Every endpoint accepts HTTPS only, and HTTP requests are redirected with a 301.

API Key Authentication

Every API call is authenticated with a per-app API Key. Keys are stored hashed with bcrypt and are never exposed in plaintext.

Rate Limiting

Per-IP and per-API-Key request limits block brute-force and DDoS attacks.

CORS Policy

An Origin-based CORS policy ensures that only allowed domains can access the API.

Password Hashing

User passwords are hashed and stored with bcrypt (cost factor 12). Plaintext storage is never used.

Sensitive Data Encryption

Sensitive information such as API Keys and tokens is encrypted at rest with AES-256-GCM.

Data Isolation

In a multi-app environment, data is fully and logically isolated between apps.

Pseudonymized Processing

A fingerprint is a one-way hash combining signals such as IP, OS, device model, and resolution. It contains no names, email addresses, or contact details, and we never use it to determine a person's real-world identity. Because such an identifier can still recognize a device over time, we treat it as personal information under applicable laws (including the CCPA/CPRA) and apply strict data-minimization, short retention, and contractual processor safeguards.

Automatic Expiry (72h TTL)

Fingerprint data is kept in Redis for only 72 hours and is automatically deleted afterward.

Optional IDFA/GAID Collection

Advertising identifiers (IDFA/GAID) are collected only with the user's explicit consent and are used solely for deterministic matching. They are never sold or shared with third parties for cross-context behavioral advertising, and users can withdraw consent at any time through their device settings.

Container Isolation

Every service runs in a Docker container under the principle of least privilege.

Network Segmentation

Internal services (DB, Redis) run on a private network with external access blocked.

Automated Monitoring

Health-check failures and abnormal traffic trigger real-time alerts for immediate response.

API Request Logging

Every API call is logged with request/response metadata (excluding payload bodies).

Access History Tracking

Audit logs are kept for key actions such as dashboard logins and link create/update/delete operations.

Log Retention

Audit logs are retained for at least 90 days and can be extended to meet compliance requirements.