Safe, private, and verifiable.
Every claim on this page is something we can show you — not just tell you. Facts, dates and named things, for the person filling in the questionnaire.
Illustration: the rii.link routing core sealed behind its security boundary — TLS in front, abuse checks, the tenant-partitioned database, EU residency in Frankfurt, and the append-only audit log.
Five hops. Each one sealed.
Not the data path — the security boundary. See how a click becomes a dashboard row on /analytics; here's what happens to the request itself, hop by hop.
Every request negotiates TLS 1.2 or newer — 1.3 preferred — before anything else happens. Plain HTTP serves exactly one thing: a redirect to HTTPS.
Write endpoints and public forms pass named bot checks — honeypot fields, render-to-submit timing, proof-of-work on suspicious traffic. The redirect itself skips all of it and stays fast.
honeypot: empty ✓ · render→submit: 1.2 s ✓ · pow: nonce accepted ✓
The slug resolves with a single O(1) read from an in-memory replica. The redirect path holds no write credentials — a compromised edge node couldn't alter a single link.
Every row carries a tenant_id, and every query is scoped to it at the repository layer. Crossing tenants isn't forbidden by policy — it's architecturally impossible to express.
The 301 goes back in milliseconds. What we keep is aggregated and anonymous; what identifies you is dropped at the edge.
utc timestamp
country = DE
device = mobile
raw ip, after geo lookup
fingerprints — never built
third-party cookies — none
abuse checks never touch the redirect hot path — the click stays at 11 ms ↓
Boring, on purpose.
Anycast edge, EU-resident storage, and a public status page — availability is a security property here, not a marketing one.
Where every byte lives.
Residency per data type — not a blanket claim — plus the encryption and retention facts a questionnaire actually asks for.
Slugs, destinations, rules — the system of record.
Aggregated counters — country and device class only.
QR exports and uploads on AWS S3.
no us mirror · backups stay in region
We do not sell click data. Not aggregated, not “anonymized”, not ever.
The parts your pentester greps for.
One fact per line — the implementation detail lives on /developers.
What’s real, what’s roadmap.
Named mechanisms only. Where something isn’t live yet, it says so — this page never implies.
Status, not spin.
In progress means in progress — never hidden, never dressed up as certified.
Observation window underway. In progress ≠ certified — the report gets published here the day it exists, not before.
Standard template with processor terms, TOMs and the subprocessor list — request from sales@rii.link, countersigned in days.
† maxmind geolite2 is queried locally — ip addresses never leave our infrastructure. change notice: 30 days by email.
security.txt, published.
RFC 9116, at the well-known path — so a researcher who finds something reaches a human in minutes, not a contact form.
Mid-security-review?
Send the questionnaire — the engineers who built the request path answer it, with the DPA and subprocessor list ahead of the call.
SLA, migration and rollout live on /solutions/enterprise — same figures, same contract.