Safe, private, and verifiable.
Every claim on this page is something we can show you — not just tell you. Facts, dates and named things, for the person filling in the questionnaire.
Illustration: the rii.link routing core sealed behind its security boundary — TLS in front, abuse checks, the tenant-partitioned database, EU-first handling with visitor IPs anonymised before storage, and the request log.
Five hops. Each one sealed.
Not the data path — the security boundary. See how a click becomes a dashboard row on /analytics; here's what happens to the request itself, hop by hop.
Links on your domains are served over HTTPS, with certificates issued and renewed automatically — nothing for you to upload, nothing to forget to renew.
Public forms pass named bot checks — honeypot fields, render-to-submit timing, and a Turnstile check on every form that sends email or reaches our team (on the shortener, only when a submission looks automated). The redirect itself skips all of it.
honeypot: empty ✓ · render→submit: 3.4 s ✓ · turnstile: passed ✓
The path resolves with O(1) reads from Redis. The routing service only reads link configuration — changes arrive solely through the API, never from the redirect path.
Every tenant-owned row carries a tenant_id, and queries are scoped to it at the repository layer — isolation is built into the data layer, not left to code review.
The redirect goes back in milliseconds. Analytics keeps request metadata, but the visitor IP is truncated to a /24 IPv4 or /48 IPv6 network prefix before durable storage.
utc timestamp
country = DE
device = mobile
raw ip, after geo lookup
fingerprints — never built
third-party cookies — none
abuse checks never touch the redirect hot path ↓
Boring, on purpose.
Separate read and write paths, a public status page, and a 99.99% SLA on Enterprise — availability is a security property here, not a marketing one.
What we keep, and how.
Per data type — not a blanket claim — plus the transport and retention facts a questionnaire actually asks for. EU-first — visitor IPs anonymised before storage.
Paths, destinations, rules — written by the API, read by routing.
Country, device, browser, referrer and UTM tags — IP truncated first.
Generated QR codes and uploaded assets.
every processor and its country · privacy policy §7
We do not sell click data. Not aggregated, not “anonymized”, not ever.
The parts your pentester greps for.
One fact per line — the implementation detail lives on /developers.
What’s live, by name.
Named mechanisms only. Where something isn’t live yet, it says so — this page never implies. Seen a bad link? Report it.
Status, not spin.
Not certified means not certified — never hidden, never dressed up as more.
We hold no SOC 2 report today and don't claim a date for one. Ask for our security documentation instead.
Standard template with processor terms and the subprocessor list — request from sales@rii.link, countersigned in days.
ip-to-country lookups use a locally hosted database — ip addresses are not sent to a third party. countries per processor: privacy policy §7.
security.txt, published.
RFC 9116, at the well-known path — so a researcher who finds something reaches a human in minutes, not a contact form.
Mid-security-review?
Send the questionnaire — the engineers who built the request path answer it, with the DPA and subprocessor list ahead of the call.
SLA, migration and rollout live on /solutions/enterprise — including the 99.99% uptime SLA on Enterprise.