1. Overview
Security is built into every layer of 2xurl — from how you sign in to how a short link redirects. This page describes the measures we use today. It is not a certification; if you need specific details for a security review, contact [email protected].
Strong sign-in
Argon2id password hashing, two-factor authentication and rotating sessions.
Safe links
Destinations are checked against Google Safe Browsing; abusive links are disabled.
Private analytics
Visitors are counted with a daily rotating hash — raw IP addresses are never stored.
2. Account Security
- Passwords are hashed with Argon2id, a modern algorithm designed to resist cracking.
- Two-factor authentication with any authenticator app, plus single-use recovery codes.
- Sessions use a secure, http-only cookie and short-lived access tokens that rotate.
- Repeated failed sign-ins are rate-limited and temporarily locked out.
- Resetting a password signs out every existing session.
3. Data Protection
- Encryption in transitEvery page, API call and redirect is served over HTTPS.
- Hashed credentialsPasswords use Argon2id; API keys are stored only as hashes and shown once.
- Encrypted secretsSensitive settings such as provider keys are encrypted with AES-256-GCM at rest.
- Locked-down serversA firewall exposes only web and SSH ports; databases are never reachable from the internet.
- Signed webhooksEach delivery carries an HMAC signature so you can verify it came from 2xurl.
- No card storagePayments are handled by our payment providers; we never see full card numbers.
4. Link Safety
- New link destinations are checked against Google Safe Browsing for phishing and malware.
- Destinations must be ordinary web addresses: we block private and internal network addresses and embedded credentials.
- Anyone can report a harmful link; reported links are reviewed and can be taken offline everywhere at once.
- Link-preview bots always see the main destination, so routing rules cannot be used to hide a link from scanners.
5. Infrastructure
- Traffic passes through Cloudflare, which provides HTTPS and protection against attacks.
- Servers run a firewall that allows only web and SSH traffic; internal services listen only on the private interface.
- Brute-force SSH attempts are blocked automatically.
- Databases are backed up every night.
6. Payments
Payments are processed by Razorpay, Cashfree or PayPal. Payment details go directly to them — we never receive or store full card numbers. Credit is added to your wallet only after the payment is confirmed through the provider's signed notification or a server-side check with the provider.
7. API & Webhooks
- API keys are stored as hashes, shown only once, and limited to the scopes you choose.
- Each key has per-minute and monthly rate limits.
- Webhook deliveries include an HMAC signature in the X-2xurl-Signature header.
8. Privacy by Design
We collect only what the Service needs. Unique visitors are counted with a hash that rotates daily, so raw IP addresses are never stored and visits cannot be linked across days. Raw click events are deleted after 90 days. Read the full Privacy Policy.
9. Keeping Your Account Safe
- Turn on two-factor authentication in Settings and keep your recovery codes offline.
- Use a unique password, or sign in with Google or WhatsApp.
- Give each integration its own API key with only the scopes it needs, and revoke keys you no longer use.
- Review your team members regularly and remove people who no longer need access.
10. Reporting a Vulnerability
Found a security issue? Email [email protected] with steps to reproduce. We aim to acknowledge reports within 3 business days.
When researching, please:
- only test against your own account and data;
- avoid denial-of-service, spam and social engineering;
- don't access, change or delete other people's data;
- give us reasonable time to fix the issue before sharing it publicly.
We won't take legal action against good-faith research that follows these guidelines.