logo

Security & Trust

We build CodeQR to be trustworthy by default. This page summarizes how we protect your data, the privacy controls we honor, and how to reach us about security. Where a topic has a formal policy, we link to it.

Data protection & privacy

Our policies describe exactly what we collect and why — and we keep them truthful.

  • Plain, accurate Privacy Policy and Cookie Policy — what we collect, why, and for how long.
  • Consent-first tags: on our marketing site, Google Analytics and advertising tags load only after you opt in, using Google Consent Mode v2 (default denied). We honor the Global Privacy Control (GPC) browser signal. Aggregate page views are also measured without cookies, using a hash of the request that is discarded after 24 hours and never identifies you across sites.
  • Data minimization: we keep the personal data we process to what the service needs. See the Privacy Policy for specifics on retention.
  • International transfers are governed by Standard Contractual Clauses and the UK Addendum through our Data Processing Addendum.
  • We publish and keep current the full list of subprocessors that help us run the service.

Infrastructure & hosting

We run on established providers. Traffic is encrypted in transit, and our providers encrypt stored data at rest.

  • Hosting and edge network on Vercel; primary database on PlanetScale; event analytics on Tinybird (European Union); cache and queues on Upstash.
  • Encryption in transit: all traffic is served over HTTPS/TLS.
  • Encryption at rest: our infrastructure providers encrypt stored data at rest.
  • Provider locations and the data each processes are listed on our subprocessors page.
  • Live service status and uptime are published on our status page.

Application security

Controls that protect accounts and the links and QR codes you create.

  • Authentication through established providers — email and OAuth sign-in (next-auth).
  • Optional two-factor authentication (TOTP) for password sign-in, using an authenticator app plus single-use backup codes. Available on any account.
  • Role-based access control within workspaces.
  • Workspace audit logs (available on higher plans).
  • Rate limiting on sensitive endpoints.
  • Malicious-URL screening: destination URLs are scanned against Google Web Risk, and abusive links are disabled.

Your rights & data control

You stay in control of your data.

  • Access & portability: request a copy of your personal data by emailing contact@codeqr.io.
  • Deletion: you can delete your account and its data from your account settings.
  • Consent & cookies: change your consent choices at any time from the cookie settings.
  • Your rights under GDPR, UK GDPR, LGPD, and US state privacy laws are described in our Privacy Policy.

Reporting a vulnerability

We welcome good-faith security research.

  • Report security issues to contact@codeqr.io. A machine-readable security.txt is published at the standard location.
  • Safe harbor: research conducted in good faith under our disclosure guidelines is authorized — we won't pursue legal action for good-faith testing that respects user privacy and service availability.

Compliance posture

Where we stand today — stated plainly.

  • We align our practices with GDPR, UK GDPR, LGPD, and US state privacy laws (see the Privacy Policy and DPA).
  • CodeQR is not currently certified under SOC 2 or ISO 27001. We follow aligned practices and will pursue formal certification as our customers require it.

Questions

Questions about security or privacy? Email contact@codeqr.io.