Security

Written down, so you can hold us to it.

Your QR codes are printed on physical packaging and have to keep working for years. This page describes what PaqLink enforces in software today — and, just as plainly, what we don't yet claim.

Accounts & sessions

  • Passwords are stored as scrypt hashes; minimum 10 characters. There are no support back doors or "auto-unlock" paths.
  • Sessions use signed, HttpOnly, SameSite cookies marked Secure in production, rotated on login and registration to defeat fixation. 14-day lifetime.
  • CSRF protection on every state-changing form, compared in constant time.
  • Rate limiting on login, registration, password reset and invite acceptance.
  • Invites and password resets use 32-byte random tokens that are stored hashed, are single-use, and expire (7 days / 1 hour). A database leak mints nothing.

Workspace isolation

  • Every product, billing and team query is scoped to your organisation. A request for another organisation's data returns "not found" — existence is not revealed.
  • Permissions are enforced by capability (who may bill, invite, publish), never by matching role names in page code.

Payments

  • Card details never touch our servers — checkout is handled by Paystack.
  • Payment webhooks are verified with HMAC-SHA512 over the raw body in constant time; replayed events are no-ops; an amount mismatch quarantines the payment rather than upgrading the plan.

Transport & browser hardening

  • TLS everywhere, with HTTP Strict Transport Security.
  • A Content Security Policy that forbids inline and third-party scripts on every page, plus nosniff, strict referrer policy and clickjacking protection (your public product pages and e-labels are intentionally embeddable; everything else is frame-denied).

E-labels & scan privacy

  • The server refuses to emit any script on an e-label page — the EU no-tracking rule is a hard guard, not a policy.
  • Scan statistics are one aggregate counter per product per day. No IP addresses, device details or per-scan records are stored. Privacy policy →

The resolver your codes point at

  • Administrative access to resolver records requires a bearer token compared in constant time; the token is held as a secret, never in code.
  • Malformed input returns 400/404 — a corrupt record degrades to "not found", never to an error loop that would take a printed code down with it.
  • Because codes are plain GS1 Digital Link URIs, nothing about them depends on proprietary PaqLink formats. Standards →

What we don't claim (yet)

  • No two-factor authentication yet — it's on the roadmap.
  • No formal third-party audit or certification (SOC 2, ISO 27001) has been performed.
  • Product images are hot-linked from URLs you supply; we don't host uploads today.

Reporting a vulnerability

Email security@paqlink.com. We read every report, reply to real findings, and won't pursue researchers acting in good faith.