Security
How we handle your data and your visitors'.
No marketing fluff — a factual rundown of the controls in place today. Anything on the roadmap is called out at the bottom.
Transport
HTTPS on every request, terminated at the Cloudflare edge. The API and this site send HSTS (one year, including subdomains) so browsers refuse to downgrade.
Authentication
Passwords are hashed with PBKDF2-SHA256 (100,000 iterations, per-user salt). The cookie that unlocks a password-protected link is an HMAC envelope bound to that link, so a leaked cookie cannot be replayed against another. Access tokens are short-lived JWTs (15 minutes) that the dashboard keeps in memory; refresh tokens last 7 days, are replaced on every use, and sit in an httpOnly, Secure cookie. API keys are SHA-256 hashed at rest; only the first eight characters (the prefix) are stored in plain text so the UI can show you which key is which.
Network safety (SSRF guard)
Every destination URL — whether it arrives via the dashboard, the API, the importer, or the moderation queue — is checked against an SSRF allow-list (isSafePublicUrl). Workspaces cannot point a short link at an internal hostname, a private RFC1918 range, link-local addresses, or the Cloudflare metadata service.
Rate limiting
Requests are counted per client IP (the cf-connecting-ip header, which Cloudflare sets and clients cannot spoof) and per top-level path in a fixed 60-second window: 60 requests for unauthenticated calls, 300 when authenticated with a JWT or API key. Over the limit returns 429 with a Retry-After header.
Content moderation
Every new link's destination is fetched and classified by a Workers AI model before the redirect goes live. Links that fail moderation never resolve — visitors see a branded blocked page instead. A daily cron re-checks links older than 30 days so a destination cannot be quietly repurposed for malware after launch.
Audit log
The audit log records API keys created or revoked; members added, removed or given a new role; workspace deletion; conversions recorded. Each entry has the actor, the time and the before/after values. Link and branding edits are not audited yet. API-key, membership and workspace entries also record the IP address the change came from. Retention is set per workspace, from 1 day to 10 years (90 days by default), and a daily job prunes older entries.
GDPR consent
Workspaces can enable a plain-language consent prompt on their short links. Visitors who decline still reach the destination, but no click event is recorded — only an anonymous counter is incremented.
Hosting and region
OrphLink runs on Cloudflare Workers (compute), D1 (relational data), KV (counters and cache), R2 (logo and favicon assets), and Analytics Engine (click events). Requests are served from the nearest Cloudflare location; storage is not pinned to a single country.
Vulnerability disclosure
Found something? Please email security@orphl.ink (or hello@orphl.ink if that bounces) with reproduction steps, expected impact, and any tooling output. We aim to acknowledge within two business days and triage within five. Please don't run automated scanners against production — we'll happily set up a test workspace if you want to dig deeper.
Compliance
OrphLink is not certified for SOC 2 or ISO 27001. The platform runs entirely on Cloudflare. For procurement questionnaires or DPA requests, email hello@orphl.ink and we'll respond with what we have.