Security

What we do

Controls that are in the product today.

• Tenant isolation in the database

  Account data lives in Postgres tables protected by row-level security. A query that runs for one account cannot read another account's rows.

• Encryption

  Traffic to qraffic is encrypted with HTTPS. Our database and hosting providers encrypt stored data at rest.

• Scan data without raw IP addresses

  We never store a scanner's IP address. We keep one-way hashes, keyed with a secret that lives only on our servers, to count unique scans and spot abuse.

• API keys stored as hashes

  We keep a SHA-256 hash of each API key, not the key. A key is shown once when you create it.

• Roles

  Team members are owner, admin or member. Inviting or removing members and managing API keys need an admin or owner.

• Audit log

  Account changes are recorded in an audit log you can read and export, on Pro and above.

• Rate limiting

  Sign-in, checkout, invites and API requests are rate limited.

• Browser protections

  Pages are served with a Content Security Policy and clickjacking protection.

• Card data stays with Stripe

  Card numbers go to Stripe. They never reach our servers or database.

Who processes data

Providers that handle account or scan data for the core product.

• Vercel

  Application hosting, content delivery and file storage

• Neon

  Database hosting and sign-in

• Upstash

  Caching, rate limiting and background jobs

• Stripe

  Payment processing and billing

• Sentry

  Error monitoring

• OnyxMetric

  Website and scan analytics, operated by Cuanto Labs

• Mail API

  Sends transactional email: sign-in links and codes, invites, receipts and billing notices

Optional features, such as AI tools or physical mail, add their own providers when you turn them on. The complete list is in the sub-processor list, and the data processing addendum covers how we handle customer data.

Questions and reports

Security review for procurement, or a problem you found.