Campaign data protected by design.
Short links are public by nature and infrastructure by consequence. Everything below describes what the product actually does today — including what it doesn’t.
What's in place.
Secure authentication
OIDC sign-in with httpOnly session cookies. Tokens are never parked in localStorage where a script can read them.
Workspace isolation
Every query is scoped to the workspace that owns the data. One client's links are unreachable from another's session.
Role-based access
Owner, editor and viewer roles are enforced server-side, not hidden in the UI.
Encrypted transport
All traffic is served over TLS, including every branded domain and short link.
Audit logs
Sensitive actions are recorded to an append-only audit log that rejects updates and deletes at the database level.
Abuse protection
Per-IP rate limiting on public endpoints, with tighter limits on sign-in and the free link tool.
Link scanning protections
Destinations are fetched through an SSRF-safe client that refuses internal and reserved addresses, and re-validates every redirect hop.
API key controls
Keys are scoped, listable and revocable, so an integration can be cut off without rotating anything else.
How each one actually works.
The mechanism, not the marketing word.
How sign-in works
Authentication runs through an OIDC provider behind a backend-for-frontend. The browser holds an httpOnly session cookie — it never holds a token that a script on the page could read, which is what makes an XSS bug into an account takeover elsewhere.
How your data stays yours
Every query is scoped to the workspace that owns the record. An agency's client A cannot reach client B's links by changing an id in a request, because the ownership check happens server-side on the way in, not in the UI on the way out.
How we fetch your destinations
Checking a link means fetching a URL you gave us — a textbook SSRF surface. Requests go through a client that resolves and validates the destination IP at connect time (closing DNS rebinding), refuses private and reserved ranges, re-validates every redirect hop, and caps both the redirect count and the response body.
How actions are recorded
Sensitive operations are written to an audit log that is append-only at the database level: a trigger rejects UPDATE and DELETE outright. An audit trail that the application could quietly rewrite isn't an audit trail.
How abuse is contained
Public endpoints are rate limited per IP, with tighter dedicated limits on sign-in, the free link tool and the enquiry forms, so no single surface can exhaust another's budget.
How integrations are scoped
API keys are individually scoped, listable and revocable. Cutting off one integration doesn't mean rotating credentials for all of them.
What we don’t have yet
Vendors rarely publish this list. It’s the part you’d find out in procurement anyway, so here it is up front.
- We do not hold SOC 2 Type II or ISO 27001 certification. When we do, it will be stated here with the report available under NDA — not before.
- We are not currently listed on a public trust portal or status page. Uptime is not yet published from a monitored source, so we don't claim a number.
- Single sign-on and white-label are available on the Enterprise plan; they are not part of the lower tiers.
Reporting a vulnerability
If you believe you’ve found a security issue, email security@tracklinkhq.com. Tell us what you found and how to reproduce it. We’ll acknowledge within two business days and won’t pursue legal action against good-faith research.
For data-processing questions, see our Privacy Policy or talk to our team.
Make every campaign link accountable.
Create your first short link for free, or talk to us about managing campaigns across your team.
No card required · Free plan available · Anonymous links live for 24 hours