Security at QuickQRC

Last updated: 4 November 2026

This page describes how QuickQRC protects accounts, codes and the people who scan them. It covers what we do today and says plainly what we don't have yet, so you can judge whether QuickQRC fits your own security review. For what personal data we hold and why, see the Privacy Policy.

QuickQRC
Security at a Glance · No. 0001
Static code content Never sent to us
The free generator builds codes in your browser, so there is nothing on our side to leak.
Connections HTTPS only
Plain HTTP is redirected, and browsers are told to use HTTPS for a year.
Two-factor sign-in Every plan
Authenticator-app codes with one-time recovery codes, free accounts included.
Card details Never on our servers
Paddle runs checkout as merchant of record and holds the payment data.
SOC 2 or ISO 27001 Not yet
We hold no third-party security certification today. Details below.

QuickQRC is a small company. We have not been audited for SOC 2, ISO 27001 or HIPAA, and we don't claim to meet them. If your organisation requires one of these, QuickQRC will not pass that check today, and we'd rather you know now than find out during procurement.

What we do offer: the data rights in our Privacy Policy (access, correction, export and deletion) for everyone, wherever they live, with GDPR, UK GDPR and US state privacy laws such as the CCPA in mind; and a Scan Privacy Policy for the people who scan your codes.

  • Every page, short link and API call is served over HTTPS. Requests over plain HTTP are redirected.
  • We send a Strict-Transport-Security header for one year, including subdomains, so browsers that have visited once refuse to connect without HTTPS.
  • Pages carry a Content Security Policy that only allows scripts we have approved, and headers that stop other sites framing our pages or guessing file types.
  • Passwords are at least 8 characters and stored only as salted hashes, using the standard ASP.NET Core Identity hasher. We can't read them.
  • Two-factor authentication with an authenticator app is available on every account, with one-time recovery codes in case you lose your phone.
  • Guessing is slowed down. An account is locked for a short time after repeated wrong passwords, and each IP address is limited to a few sign-in attempts a minute.
  • Password reset links expire after one hour.
  • Sign in with Google or Microsoft is available, so you can rely on your existing account's protections instead of another password.
  • Sign-in history records the time, method, IP address and device of each sign-in for 90 days, so we can investigate a compromised account.
  • Roles: each team member is a Viewer (read only), Editor (manages codes and pages), Admin (also manages members) or Owner (also manages billing and can delete the account).
  • Activity log: team Admins and the Owner can see a log of security-relevant actions, such as sign-ins, plan changes and member changes.
  • Single sign-on on the Business and Enterprise plans: SAML or OIDC through WorkOS, or your own OIDC provider. The Owner can require SSO for every member, and keeps a password fallback so a broken identity provider can't lock the account.
  • API keys are shown once when you create them. We keep only a SHA-256 hash, so a key can't be recovered from our database, only revoked and replaced.
  • Scopes: keys are read-only unless you choose to give them write or bulk access when you create them.
  • Rate limits: each key is limited per minute and per month.
  • Webhooks go only to HTTPS addresses on the public internet, never to private or local networks. Each one is signed with HMAC-SHA256 over a timestamp and the body, in a QuickQRC-Signature header, so your endpoint can check that a request came from us, wasn't changed and isn't a replay. The Integrations page in your dashboard explains how to check it.
  • No IP addresses are stored for scans. We look up country and city in an offline database on our own server and then drop the address. Unique visitors are counted with a hash whose salt changes daily.
  • Password-protected codes: the password a visitor types is checked and not stored, and guesses are limited per visitor and per code.
  • Uploads are checked by their actual content, not just their file name, before we accept them.
  • Abuse: anyone can report a code that leads to phishing, malware or anything illegal. We can disable it, so everyone who scans it sees a warning instead of the destination.
  • Account data, codes and scan records are kept in a managed Neon Postgres database, with encrypted backups.
  • The website and uploaded files run on a Windows server that we manage through Plesk.
  • Only the people who run QuickQRC can reach production data, and only to operate and support the service.
  • Scan records are deleted on a schedule tied to your plan's analytics history, as described in the Privacy Policy.
  • You can delete your account yourself from Pro settings. That removes your codes, pages, uploads and their scan history.

Paid plans are sold by Paddle as merchant of record. You enter card details on Paddle's checkout, not on our servers, and Paddle is responsible for keeping them secure. We receive a customer and subscription ID, the plan and its status, never the full card number. Billing messages from Paddle to us are checked against a shared secret before we act on them.

We don't publish an uptime commitment or a status page for self-serve plans yet. When we have one, it will be listed here. A printed dynamic code keeps redirecting if a subscription lapses; see what happens when a subscription ends.

If you think you've found a security problem in QuickQRC, please email contact@quickqrc.com with "Security report" in the subject. Tell us what you found, the steps to reproduce it and what an attacker could do with it.

  • We'll confirm we received it and keep you updated while we fix it.
  • Please don't access other people's data, run denial-of-service tests or use automated scanners that flood the site.
  • We don't run a paid bug bounty, but we're glad to credit you once the fix is live.
Contact Us