Customer Trust Pack

reRoute is a multi-tenant SaaS application. It creates QR codes and dynamic shortlinks, and it records scan analytics. The application runs on Netlify. It stores data in Prisma-managed PostgreSQL. It uses Stripe for billing, Upstash Redis for rate limiting and caching, and Resend for transactional email.

Each customer belongs to a workspace, which is the tenant boundary. Every link, QR code, scan event, conversion, API key, webhook, and setting carries a workspace identifier. The application scopes every read and write to the active workspace at the query layer, and a source-lock test suite proves that every tenant table is only reached through that scope. One workspace cannot read or change another workspace's data. Agency client sub-workspaces are isolated the same way.

All traffic uses HTTPS/TLS. Data at rest is encrypted by our infrastructure providers (Prisma-managed PostgreSQL and Netlify). Link passwords are stored as salted scrypt hashes. API keys are stored as SHA-256 digests of high-entropy random tokens. Webhook signing secrets cannot be hashed — HMAC signing needs the original secret — so they are encrypted at rest with AES-256-GCM under a key held in the application environment rather than the database, and decrypted in memory only when a delivery is signed. They are redacted from data exports.

The application handles account authentication itself: sessions, linked identities and salted password hashes live in our own database, and no third-party identity service holds them. Each workspace uses four roles: owner, admin, member, and viewer. A viewer has read-only access. Roles are enforced in server actions, not only in the user interface. REST API and MCP access use per-workspace bearer tokens. API keys carry permission scopes (links:read, links:write, analytics:read, track:write) that the application enforces on every call.

The application writes security-relevant actions to an append-only, tenant-scoped audit trail. Audited actions include role changes, credential lifecycle, domain changes, data exports, billing changes, link deletions, retention changes, and scan-data purges. Owners and admins can review the audit trail in the dashboard.

Scan IP addresses are anonymized at write time (IPv4 to /24, IPv6 to /48). Owners and admins can export all workspace data as JSON, with credentials redacted. Owners can permanently delete a workspace. Owners can also set an optional scan-data retention window; a daily scheduled job then deletes scan events older than that window, and owners can run the purge on demand as well. The default is to keep scan data until the customer removes it.

Public endpoints are rate limited with a distributed limiter, so limits hold across serverless instances. The application validates redirect destinations and outbound webhook targets to block internal and private network ranges (SSRF protection), and it escapes user-supplied content in interstitial pages.

• Prisma Data Platform — PostgreSQL hosting.
• Netlify — application hosting and edge routing.
• Stripe — billing and payments. Stripe processes card data directly; reRoute does not store full card numbers.
• Upstash — rate limiting and link caching (Redis).
• Resend — transactional email.

reRoute holds no third-party security certifications today. It is not SOC 2 audited, and it does not claim to be. SAML 2.0 single sign-on against your own identity provider — Okta, Microsoft Entra ID, Google Workspace, or any SAML IdP — is included in the Enterprise plan, self-serve, with SCIM directory sync for Okta and Entra ID. Setup guides live at /docs/sso. reRoute does not offer a contractual SLA.

Report a suspected vulnerability to loading... before any public disclosure. Send enterprise security and procurement questions to loading.... The team will respond promptly and can review the current security posture under NDA.

Send reports of abusive or illegal destinations to loading.... Include the shortlink URL. You do not need an account. The public policy page is /security/takedown.

Staff review each report. A report does not auto-block a link. reRoute does not promise a response time. There is no SLA for abuse reports. A report does not pause a link. Printed QR codes continue to open a page.

A platform administrator may remove the destination for that link only. After a staff takedown, a scan opens an HTTP 200 HTML page that states the destination was removed. That page has no Continue control to the old destination. Takedown applies to one destination row. reRoute does not block the rrte.link host because one back-half was abused.

Cancelling a subscription does not disable existing QR codes. Existing links keep redirecting. Report security vulnerabilities to loading.... Do not send vulnerability reports to the abuse mailbox.