clicktrail / security
The security posture, including the gaps.
Short links are public by nature and infrastructure by consequence. Everything below is what the product does today. The certifications section is what it doesn’t.
In detail
How each protection actually works.
The mechanism, not the marketing word.
How sign-in works
Authentication runs through an OIDC provider behind a backend-for-frontend. The browser holds an httpOnly session cookie and never a token a script on the page could read, which is what turns an XSS bug into an account takeover elsewhere.
How your data stays yours
Every query is scoped to the workspace that owns the record. An agency's client A cannot reach client B's links by changing an id in a request, because the ownership check happens server-side on the way in rather than in the UI on the way out.
How access is enforced
Owner, editor and viewer roles are checked server-side on every request. A hidden button is not access control.
How traffic is encrypted
All traffic is served over TLS, including every branded domain and every short link.
How we fetch your destinations
Checking a link means fetching a URL you gave us, which is a textbook SSRF surface. Requests go through a client that resolves and validates the destination IP at connect time, which closes DNS rebinding, refuses private and reserved ranges, re-validates every redirect hop, and caps both the redirect count and the response body.
How actions are recorded
Sensitive operations are written to an audit log that is append-only at the database level: a trigger rejects UPDATE and DELETE outright. An audit trail the application could quietly rewrite isn't an audit trail.
How abuse is contained
Public endpoints are rate limited per IP, with tighter dedicated limits on sign-in, the free link tool and the enquiry forms, so no single surface can exhaust another's budget.
How integrations are scoped
API keys are individually scoped, listable and revocable. Cutting off one integration doesn't mean rotating credentials for all of them.
Certifications and roadmap
Where our compliance posture stands today, published before procurement asks.
- We do not hold SOC 2 Type II or ISO 27001. We will say so here the day we earn either, and share the report under NDA.
- We are not on a public trust or status portal, and we don't publish an uptime number. We won't quote one we can't show you.
- SSO and white-label are Enterprise roadmap items. Nothing in the product enforces them today, so they appear as planned rather than as a checkmark.
Reporting a vulnerability
If you believe you’ve found a security issue, email security@clicktrailhq.com. Tell us what you found and how to reproduce it. We’ll acknowledge within two business days and won’t pursue legal action against good-faith research.
For data-processing questions, see our Privacy Policy or talk to our team.
Stop discovering campaign failures after the budget is spent.
Create and audit a campaign link for free, or talk to us about managing campaigns across your team.
No card required · Free plan available · Anonymous links live for 24 hours