What is actually in place
Connections are served over TLS. The Postgres database is encrypted at rest and snapshotted daily, with those snapshots kept for thirty days.
API keys are stored only as a SHA-256 hash plus an eight-character prefix, so a key cannot be recovered from the database even by us — if you lose one, you rotate it. Each key carries its own scopes, its own rate limit and an optional IP allowlist.
Outgoing webhook payloads are signed with HMAC-SHA256 using a secret that belongs to that subscription alone, so your endpoint can verify that a delivery came from us before it acts on it.
Safety for the person scanning
A scan sets no cookie and stores no raw IP address: the visitor address is anonymised at write time, before it reaches storage. Nothing is inserted between the scan and its destination, so a scanner is not passed through an ad network or a tracking interstitial.
If you have been sent a code you do not trust, decode it before you open it. The QR safety checker reads the payload and reports the patterns behind QR phishing without following the link.
What is deliberately not claimed
No third-party security certification, compliance attestation or external penetration-test report has been issued for Qrindo, so none is claimed here. There is no historical uptime log yet either; the status page shows live checks against the API, the dashboard and the redirect path, and that is the extent of what can be shown.