How we protect your data

• All traffic is served over HTTPS/TLS. We send HSTS with a two-year max-age, includeSubDomains, and preload, so browsers refuse to talk to us over plain HTTP.
• Data at rest is encrypted by our database, storage, and cache providers using AES-256 on managed AWS infrastructure.
• Account passwords are handled by Supabase Auth and are never stored by us in any readable form. Link passwords you set are bcrypt-hashed — we cannot read them back, only verify them.
• Every response carries X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a strict-origin-when-cross-origin Referrer-Policy, and a Permissions-Policy denying camera, microphone, and geolocation by default.

• Your primary data lives in managed PostgreSQL on AWS (ap-southeast-1), with automated backups run by our database provider.
• Click analytics never store a raw IP address. We resolve an approximate location, then keep only a SHA-256 hash of the IP for deduplication and fraud detection — the original is discarded and cannot be recovered from the hash.
• Analytics retention is bounded by your plan. Older raw click rows age out; aggregates remain.
• Uploaded files (QR media, PDFs, collections) are stored in Supabase Storage with access scoped to your workspace.

• Workspaces are isolated: every query is scoped to a workspace, and membership carries a role (owner, admin, member, viewer).
• Two-factor authentication (TOTP) is available on every account, and Business/Enterprise workspaces can require it for all members.
• SSO via SAML/OIDC is available on Enterprise plans.
• Sensitive actions are written to an append-only audit log with the actor, the change, and a timestamp.
• API keys are scoped and revocable, and every API and redirect path is rate-limited.

• We process link and scan data as your processor — it is your data, and we do not sell it or use it to build advertising profiles.
• Consent tooling is built in: you can require a cookie/consent prompt on bridge and interstitial pages, and analytics respect the visitor's choice.
• Because we hash IPs at ingest rather than storing them, our analytics are pseudonymous by design.
• A Data Processing Agreement (DPA) is available on request — email security@ryabils.com.
• To export or delete your account data, email security@ryabils.com and we will action it. Self-serve export and deletion are on the roadmap.

• We do not currently hold a SOC 2 Type II report, and we will not claim one until an audit is complete. We would rather tell you that up front than have you find out in diligence.
• Our infrastructure providers (Vercel, Supabase, Upstash, Paddle) each maintain their own SOC 2 and ISO 27001 programs, and their reports are available from them directly.
• Card data never touches our servers. Paddle is our merchant of record and handles payments as a PCI-DSS Level 1 service provider.
• If a formal certification is a blocker for your team, tell us — it helps us prioritise the audit.

These are the third parties that may process customer data on our behalf. We keep this list short on purpose.

If you believe you’ve found a security issue, please email security@ryabils.com with enough detail to reproduce it. We aim to acknowledge reports within two business days and will keep you updated until the issue is resolved.

Please don’t run automated scans against production, access data that isn’t yours, or degrade the service for other users while testing. Report in good faith and we won’t pursue action against you.

To report abuse — phishing, malware, or spam behind a short link — use the same address and include the link. We remove malicious links and disable the accounts behind them.