Concrete measures, described without exaggeration
No system is invulnerable. Here is what we actually do to protect your content and the people who scan your QR codes.
Your files
Antivirus scanning
Every uploaded file is scanned before being accepted; an infected file is blocked.
Real type check
Extension, file signature and size are checked; images are re-encoded and stripped of metadata.
Private storage
Files are never in a public folder: they are served through temporary links, after permissions are checked.
Your access
Two-factor authentication
With an authenticator app and recovery codes; enforceable for every member of an account.
Sign-in protection
Temporary lock after repeated failures, alert on sign-in from a new device, revocable sessions.
Server-side permission checks
Every action is checked by the server according to your role; content from another account cannot be found.
The platform
HTTPS and strict headers
Encrypted traffic and a content security policy without external scripts.
Audit log
Sensitive actions are logged, with before and after values.
Analytics without IP addresses
Scans are measured without storing visitors’ IP addresses.
Hosting in Europe
Data is hosted in a data centre located in Europe.
Backups
Regular backups of the database and files.
Abuse reporting
Every public page lets visitors report content; moderation can suspend a QR code.
Think you have found a flaw? Write to us from the Contact page describing the issue; we will get back to you quickly and keep you informed of the fix.