---
title: "Security & Trust"
description: "How reRoute protects your data: tenant isolation, encryption, audit logging, GDPR data controls, rate limiting, and responsible disclosure."
canonical: https://reroutehq.com/security
---

# Security & Trust

How we protect your account, your links, and your scan data. We describe only what is actually in place today.

HTML: [/security](/security).

## Pages

- [Customer Trust Pack](/security/trust-pack) — procurement answers: tenancy, encryption, authentication, logging, subprocessors, data controls, incident contact
- [Abuse reports and destination takedown](/security/takedown) — how to report an abusive destination; no SLA; printed codes are not paused
- [Privacy Policy](/privacy)
- [Terms of Service](/terms)
- [security.txt](/.well-known/security.txt) (RFC 9116)
- [SSO setup guides](/docs/sso)

## Honest posture

- We are **not SOC 2** audited and do not claim to be. A SOC 2 Type II attestation is on the roadmap; we do not claim an audit is underway today.
- There is **no contractual SLA**.
- SAML 2.0 SSO (Okta, Microsoft Entra ID, Google Workspace, or any SAML IdP) is included in Enterprise at a published price, with SCIM for Okta and Entra ID.

## Controls in production

- **Tenant isolation.** Every link, QR code, scan event, conversion and setting is scoped to a workspace at the query layer. Agency client sub-workspaces are isolated the same way.
- **Encryption.** HTTPS/TLS in transit. Data at rest encrypted by infrastructure providers (Prisma-managed PostgreSQL and Netlify). Link passwords are scrypt hashes. API keys are SHA-256 digests of high-entropy tokens. Webhook signing secrets are AES-256-GCM encrypted at rest (application-managed, not an HSM).
- **Authentication.** Handled by the application itself; sessions and password hashes live in our own database, not with a third-party identity service. Owner/admin gates on credential, role, webhook and workspace-deletion actions. API and MCP use per-workspace Bearer tokens.
- **Audit logging.** Append-only, tenant-scoped trail of role changes, credential lifecycle, domain changes, data exports, billing changes and link deletions.
- **Privacy.** Scan IPs anonymized at write time (IPv4 /24, IPv6 /48). Workspace export and permanent deletion are self-serve. Optional scan-data retention window, enforced daily.
- **Abuse protection.** Distributed rate limits on public endpoints. SSRF checks on redirect destinations and webhook targets. User-supplied interstitial content is escaped.
- **Payments.** Stripe. We never see or store full card numbers.

## Responsible disclosure

Report vulnerabilities privately to security@reroutehq.com before any public disclosure. Also listed in [/.well-known/security.txt](/.well-known/security.txt).

## Abuse reports

Report abusive destinations to abuse@reroutehq.com. Policy: [/security/takedown](/security/takedown.md). Reports are reviewed. There is no SLA. Printed QR codes are not paused.