Security

Accounts

• Passwords are stored as bcrypt hashes, never as readable text.
• Repeated sign-in attempts are blocked.
• Changing a password or suspending a company ends existing sessions straight away.

Company data

• Every data request is limited to the signed-in company.
• All traffic uses HTTPS.
• Changes to links and companies are recorded in an activity log.

Redirects

• Tracking URLs only redirect to destinations saved in the customer's account.
• Only http and https destinations are accepted.

Reporting a vulnerability

Email dhananjaybansal28@gmail.com with the details. Please give us time to fix the issue before sharing it publicly.