Written down, so you can hold us to it.

Accounts & sessions

• Passwords are stored as scrypt hashes; minimum 10 characters. There are no support back doors or "auto-unlock" paths.
• Sessions use signed, HttpOnly, SameSite cookies marked Secure in production, rotated on login and registration to defeat fixation. 14-day lifetime.
• CSRF protection on every state-changing form, compared in constant time.
• Rate limiting on login, registration, password reset and invite acceptance.
• Invites and password resets use 32-byte random tokens that are stored hashed, are single-use, and expire (7 days / 1 hour). A database leak mints nothing.

Workspace isolation

• Every product, billing and team query is scoped to your organisation. A request for another organisation's data returns "not found" — existence is not revealed.
• Permissions are enforced by capability (who may bill, invite, publish), never by matching role names in page code.

Payments

• Card details never touch our servers — checkout is handled by Paystack.
• Payment webhooks are verified with HMAC-SHA512 over the raw body in constant time; replayed events are no-ops; an amount mismatch quarantines the payment rather than upgrading the plan.

Transport & browser hardening

• TLS everywhere, with HTTP Strict Transport Security.
• A Content Security Policy that forbids inline and third-party scripts on every page, plus nosniff, strict referrer policy and clickjacking protection (your public product pages and e-labels are intentionally embeddable; everything else is frame-denied).

E-labels & scan privacy

• The server refuses to emit any script on an e-label page — the EU no-tracking rule is a hard guard, not a policy.
• Scan statistics are one aggregate counter per product per day. No IP addresses, device details or per-scan records are stored. Privacy policy →

The resolver your codes point at

• Administrative access to resolver records requires a bearer token compared in constant time; the token is held as a secret, never in code.
• Malformed input returns 400/404 — a corrupt record degrades to "not found", never to an error loop that would take a printed code down with it.
• Because codes are plain GS1 Digital Link URIs, nothing about them depends on proprietary PaqLink formats. Standards →

What we don't claim (yet)

• No two-factor authentication yet — it's on the roadmap.
• No formal third-party audit or certification (SOC 2, ISO 27001) has been performed.
• Product images are hot-linked from URLs you supply; we don't host uploads today.

Reporting a vulnerability

Email security@paqlink.com. We read every report, reply to real findings, and won't pursue researchers acting in good faith.