How your links and your visitors are protected
What we run, where data lives, who can reach it and how it leaves. Written for the person doing the vendor review.
Security overview
The practices below are the detail.
What we run. ShortZen is a Next.js application on Vercel with Postgres on Neon, Redis on Upstash for the redirect cache and rate limits, and object storage for QR images and exports. Every request between those services travels over TLS, and data is encrypted at rest by each provider.
Who can reach it. Logging in is handled by Clerk with one-time email codes. Inside a workspace, four roles decide who can create, edit, bill and view. Production access is limited to the accounts that operate the service, through the providers' own access controls and audit logs.
What happens on a click. The redirect is served from a cache keyed by domain and slug. A password-protected link sets one signed cookie after the visitor unlocks it. Audience analytics, which sets a one-year visitor cookie, is off until you switch it on. Click counts are aggregates, so there is no visitor profile to leak.
How data leaves. You can take a full account export at any time. Deleting an account removes personal data within 30 days, after a 14-day grace period in which it can be cancelled. Billing details do not pass through our servers: checkout and the customer portal are hosted by Dodo Payments, and the sub-processor list is in the Data Processing Agreement.
Six practices, in plain words
- Encrypted in transit and at rest
- TLS on every hop. Postgres and object storage encrypt at rest. Card numbers are handled by the payment provider and do not reach us.
- Login you control
- Passwordless login through Clerk: a one-time code sent to your email, so there is no account password to leak. Link passwords are compared against a signed hash, so the plaintext is not kept.
- Abuse kept off the platform
- Destinations are screened for malware and phishing, reserved slugs are blocked, and per-IP and per-user rate limits apply.
- Hardened by default
- A strict Content-Security-Policy with per-request nonces, and SSRF defences on every outbound fetch including IPv6 and DNS rebinding.
- Analytics without profiles
- Uniqueness is estimated with HyperLogLog. No cross-site cookies, and nothing is set on a redirect unless you opt in.
- Your data, your exit
- Export at any time from the dashboard. Delete the account and personal data is removed within 30 days.
Where we stand
The parts of a vendor questionnaire we can answer today, and the one we cannot.
- Payments
- PCI DSS SAQ-A self-assessment. Checkout and the customer portal are hosted by Dodo Payments, which holds PCI DSS Level 1.
- self-assessment · not a third-party audit
- Independent audit
- None yet. We answer security questionnaires directly: ask and we will send our current answers.
- security@shortzen.io
- Deletion
- Personal data is removed within 30 days of an account deletion, after a 14-day grace period in which it can be cancelled.
- /legal/privacy · retention
- Sub-processors
- Every provider that touches customer data, with the safeguard each one provides.
- /legal/dpa
- Reporting a concern
- Email the security address. Reports about live abuse go to the front of the queue.
- security@shortzen.io
Something to report?
Write to the security address and a person replies. Abuse and phishing reports go to the front of the queue.