Security and privacy
How the service protects accounts, links and the people who click them. This describes how the software works; it isn't a compliance certification.
Accounts
- Passwords are hashed with PBKDF2 (ASP.NET Core Identity's hasher). We never store them in plain text.
- Repeated failed sign-ins lock the account for 15 minutes. Resetting your password signs out every other session.
- Sessions are recorded on the server, so signing out or a password reset takes effect within seconds.
- You can turn on two-factor authentication with an authenticator app. Codes can't be reused, and ten single-use recovery codes cover a lost phone. Wrong codes count towards the same lockout as wrong passwords.
- If your administrator turns them on, you can sign in with Google, Apple or your organisation's single sign-on. Two-factor authentication still applies.
Links
- Destinations must be public http or https addresses. Links to private networks, internal hosts or other short links on this service are refused.
- New accounts must confirm their email address before creating links.
- Back-halves are never reused, even after a link is archived or deleted, so an old printed link can't be taken over.
- Every destination change is versioned and every sensitive action is written to an audit log.
Analytics and personal information
- We don't store full IP addresses. To estimate unique visitors, the network part of the address (/24 for IPv4, /48 for IPv6) is combined with the browser's user agent and a random daily salt, then hashed. Salts are deleted after the day ends, so visits can't be linked across days.
- Country is recorded only when our network provider supplies it. No device fingerprinting is used.
- Unique visitor numbers are estimates: people on the same network and browser count once per day, and one person on two devices counts twice.
- Known bots, link-preview fetchers and email security scanners are identified by their user agent and reported separately from people.
Reporting a problem
To report a security issue or an abusive link, email [email protected].