Security at QRdx

What QRdx does to protect your account, your codes and your visitors' data. Each item describes something that runs on qrdx.dev today, and the code is open source, so you can check it.

QRdx doesn't have SOC 2 or HIPAA certification, or any other security certification, and isn't promising one.

Report a vulnerability Security review? Contact us

Connections and browsers

HTTPS everywhere: Every page and API call is served over HTTPS, and browsers are told to keep using HTTPS for qrdx.dev for two years (HSTS).
Content security policy: QRdx's own pages limit which scripts, frames and connections they may load. Pages that show your account's data get a fresh nonce on every request, so a script injected into them doesn't run.
No framing by other sites: QRdx's own pages can't be shown inside another site's frame, and the screen where you approve an app can't be framed at all. Browsers are also told not to guess file types.

No passwords: You sign in with Google, GitHub or a one-time email code, or with a passkey. QRdx stores no passwords to leak.
Two-step verification: A second step with an authenticator app or a passkey, with backup codes for when you can't use it. Workspaces on Business can require it of every member.
Confirm it's you: Security changes, new API keys and webhooks, role changes and deleting a workspace ask you to confirm it's you, even when you're signed in. A confirmation lasts 10 minutes.
New sign-in alerts: We email you when a browser or device signs in to your account for the first time, and when your two-step verification settings change.
Sign-ins that end: A sign-in lasts 30 days at most, and less if you stop using it. One used from a new country and a new browser must confirm it's you, and you can sign out every other device at once.

Workspaces and teams

Single sign-on: OIDC or SAML 2.0 on Business, for an email domain you prove with a DNS record. SAML responses must be signed with SHA-256 or stronger. When a workspace requires it, every other way in is closed for that domain and sessions last 24 hours at most.
Roles: Owner, admin, member, billing and viewer. Only owners and admins manage people, domains and settings, and billing members and viewers can't change codes.
Audit log: On Business, owners and admins see who changed which code, page, member, domain, API key or setting, and can export it as CSV. Rows are kept for 365 days.
Staff access: Only QRdx staff accounts can open the admin tools, and every staff action there is recorded in an audit log.

Keys and secrets

Hashed keys and tokens: API keys and OAuth access tokens are stored only as SHA-256 hashes, so a copy of the database doesn't reveal them. Passwords on protected codes are stored as hashes too.
Encrypted integration tokens: Tokens for the tools you connect, such as Google Drive or Slack, are encrypted with AES-256-GCM.
Signed webhooks: Each webhook endpoint has its own secret, and every payload is signed with it, so your server can check it came from QRdx.

Abuse and link safety

Link checks: When a dynamic code's destination is set, QRdx checks it against Google Web Risk's lists of malware and phishing sites and refuses flagged ones. A destination that couldn't be checked in time is checked again, and its code is switched off if it's flagged.
Rate limits: The API, the MCP server, forms and other public endpoints are rate limited per key, account or IP address.
Reporting harmful codes: Anyone can report a QR code that leads to phishing, malware or a scam. Codes that break the rules are switched off.

Where data is stored

Hosting: The app runs on Vercel. Its server functions run in Washington, D.C., in the United States, behind Vercel's global edge network.
Database: Accounts, codes, scans and form responses are kept in a Neon Postgres database in AWS US East (N. Virginia). Neon encrypts data at rest with AES-256 and keeps encrypted backups.
Uploaded files: Files you upload are stored in Cloudflare R2, in its Asia-Pacific region.
Scan data: Scanner IP addresses are never stored. Unique visitors are counted with a hash that changes every day.

Your data and the paperwork

Export: Download everything QRdx keeps about your account as a ZIP from Settings, and export scans, form responses and the audit log as CSV.
Deletion: Delete codes, pages, files and form responses at any time, or your whole account. Deleted data can stay in the database provider's recovery history for a short time.
Data Processing Addendum: The DPA is part of the Terms for every customer and includes the Standard Contractual Clauses. Ask for a signed copy if you need one.
Subprocessors: The subprocessors list names every service that handles personal data for QRdx, what it does and where. We update it at least 30 days before a new one starts.

Report a vulnerability

Email support@qrdx.dev with a subject that starts with [security], and please don't post it in a public GitHub issue. Our security policy covers scope and safe harbor, and security.txt has the same contact details.

Doing a security review?

Send us your questionnaire. Enterprise contracts include answers for your review and a signed DPA.