Security

What follows is what the software does. We hold no certification and have commissioned no third-party audit, and you should treat any vendor that implies otherwise without evidence with suspicion — including us.

Accounts

• Passwords are hashed with scrypt. We never store or log a password.
• Two-factor authentication with an authenticator app, plus passkeys and security keys.
• SAML single sign-on.
• Every session is listed in your profile and can be revoked individually or all at once.
• Sign-in attempts are rate-limited and recorded, so a brute-force attempt is both slowed and visible.

Data

• Everything travels over TLS. Certificates for customer domains are issued and renewed automatically.
• Access tokens for third-party integrations are encrypted at rest with a key derived from a server secret.
• Webhooks are signed, so a receiver can prove a payload came from us.
• Backups run daily and are tested by restoring them.
• Identifying columns on old clicks are cleared on a schedule — see the retention table in the privacy policy — so the oldest data is also the least sensitive.

The admin panel

It answers on a secret path, can be restricted to an IP allowlist, and can require two-factor enrolment for every administrator. Administrator permissions are granular, and every administrator action is written to an audit log.

Reporting a vulnerability

Write to security@shortfreeurl.com. We acknowledge within one business day and aim to fix critical issues within seven days. We will not pursue anyone who reports in good faith, avoids privacy violations and service degradation, and gives us reasonable time before disclosing. We do not currently run a paid bounty programme.