Security at QRCodeKIT

Last reviewed: 27 October 2026. Questions this page doesn't answer go to [email protected].

Security facts

Certifications and hosting

Has QRCodeKIT been certified to ISO/IEC 27001?

Yes. QRCodeKIT has been certified to ISO/IEC 27001, the international standard for information security management. Our information security management system (ISMS) covers access control, cryptography, backup and recovery, secure development, supplier management and incident handling, and it's reviewed at least once a year. QRCodeKIT has also been certified to ISO 9001 for quality and ISO 14001 for environmental management, and our codes comply with ISO/IEC 18004:2024, the QR code standard.

Where is customer data hosted?

On Amazon Web Services in Frankfurt, Germany (eu-central-1). That's where QR codes, projects, account data, scan analytics, uploaded files and form responses are stored and processed. Static assets are delivered through Amazon CloudFront's global edge network, and Cloudflare protects traffic before it reaches our infrastructure.

Our operator is incorporated in the United States, so any international transfer relies on the safeguards described in our privacy policy: adequacy decisions, contractual safeguards or an applicable transfer framework. Our piece on EU-hosted QR code platforms explains what data residency means for a buyer.

Data protection

Is customer data encrypted at rest and in transit?

Yes. All data in transit is protected with TLS 1.2 or higher, including the connection to our cache layer. Our policy requires databases to be encrypted at rest with AWS Key Management Service, using keys protected by FIPS 140-2 validated hardware security modules. Responses collected through form QR codes get a second layer: they're encrypted with AES-256 at the application level before they're written to the database. API keys are stored only as SHA-256 hashes, and infrastructure secrets are delivered through AWS Secrets Manager and Parameter Store rather than built into container images.

What does a scan record, and who can see it?

Each scan records a timestamp, an approximate location (country, region and city), the device, operating system and browser, and the referrer. Location is resolved by our own geolocation service inside our infrastructure, not by a third-party API, and no scan data is sent from our servers to an outside analytics vendor. Scan analytics are visible only to the users of the account that owns the code. Webhooks sent to tools such as Zapier or Make are signed and don't include the scanner's IP address or browser details.

Access and identity

How do users sign in, and is multi-factor authentication supported?

Enterprise accounts sign in through their own identity provider with OpenID Connect single sign-on: Google Workspace, Microsoft Entra ID and ADFS, Okta, Auth0 or any OIDC-compliant provider. Multi-factor authentication, device trust and session policies are then enforced by your identity provider for team members who sign in through it. Every plan can also sign in with Google, inheriting the multi-factor protection set on the Google account.

Passwords are stored with bcrypt or Argon2 hashing, session tokens expire after one hour, password-reset links expire after ten minutes, and sign-up is protected against automated abuse by Cloudflare Turnstile. Internally, multi-factor authentication is mandatory on every critical system, and administrative access to our cloud environment is only possible through a VPN tied to corporate single sign-on.

What roles and permissions are available?

Four roles: Owner, Admin, Editor and Member, with permissions checked on every operation for codes, projects, custom domains, team management and billing. Team members join by email invitation, and only the Owner can delete the account. Each account's data is isolated from every other account's at the application level.

Is there an audit trail of who changed what?

Yes. QRCodeKIT keeps a server-side audit trail for every account. Each create, update and delete on QR codes, projects, custom domains, team members, API keys and billing is recorded with the acting user, a timestamp and the values before and after the change, and every record shows who created it and who last modified it. Actions taken by AI agents through our MCP server are recorded with the agent's identifier, the permissions used and the outcome.

AI and integrations

How are API keys, webhooks and AI agents secured?

API keys for the REST API v2 can be revoked at any time, can be given an expiry date and are stored only as hashes. Outbound webhooks are signed with HMAC-SHA256 so your systems can verify they came from us. AI assistants such as Claude and ChatGPT connect through our MCP server with OAuth 2.1 and PKCE: the assistant receives a revocable token limited to four scopes (read, create, update, delete), never your password, and every write action asks you to confirm. QRCodeKIT doesn't receive the content of your conversations with Claude or ChatGPT.

Operations and resilience

How is the platform kept available, and how fast can it recover?

The platform runs behind load balancers across multiple AWS availability zones, scales horizontally within minutes and is monitored 24/7, with automated alerts to the on-call engineer and to our CTO, COO and CEO. Our availability target is 99.9%.

Databases are backed up daily, encrypted, to a separate location, and uploaded files are backed up weekly. Every quarter we rehearse a full recovery: restoring the latest backup, redeploying the infrastructure in a new zone from code, and switching traffic over. Our recovery time objective is 24 hours, with normal operation within 36 hours. Our infrastructure is defined as code, so it can be rebuilt in another AWS region.

How is security built into development?

Every change is assessed for its security impact, passes static analysis and dependency vulnerability checks before release, and our AWS infrastructure is continuously scanned with Amazon Inspector. Everyone with access to source code signs a non-disclosure agreement, access follows least privilege and is reviewed every month, and the team takes security training at onboarding and every year.

Incidents and abuse

How are security incidents handled?

Under the incident-response procedure of our ISO/IEC 27001 ISMS. Every incident is logged in an incident register, reviewed weekly and closed with a root-cause analysis and lessons learned. If a personal-data breach occurs, our procedure includes notifying the affected customers and the relevant authorities. We follow national CERT advisories every week and maintain a threat register. Suspected incidents can be reported at any time to [email protected].

How are malicious or abusive QR codes handled?

Every QRCodeKIT short-link domain is monitored for phishing, and anyone can report a suspicious code at qrcodekit.com/report-abuse or [email protected]. Every report is reviewed within 6 hours, for our own short domains and for customers' branded domains. Customers can also protect their own codes with passwords, scheduled expiry and a custom domain that carries their brand.

Working with us

Who are your sub-processors?

We maintain a named list of sub-processors, with the purpose, location and transfer safeguard of each. Customer data is processed on Amazon Web Services in Frankfurt, with Cloudflare providing edge security; billing runs on Stripe, transactional email on Mailchimp Transactional, customer support on HubSpot, application performance monitoring on New Relic and product analytics on PostHog's EU cloud. Every sub-processor is assessed before onboarding and its certifications are reviewed every six months. The full list is available from [email protected].

Can we sign a Data Processing Agreement?

Yes. QRCodeKIT acts as your processor for the data your codes collect, and our Data Processing Agreement sets out the terms. Request it from [email protected].

Who completes our security questionnaire?

Send security questionnaires to [email protected]. They're answered by the team that runs our ISO/IEC 27001 ISMS, led by our CTO, and we complete customers' own questionnaires. For Enterprise plans, data residency and contracts, write to [email protected].

Frequently asked questions