Security
How we protect your links and data
The specific measures built into Lnki.io, in plain language, so you can judge them for yourself.
Your account
- Passwords are hashed with bcrypt and never stored in readable form.
- Sign-in, signup and password-reset requests are rate limited, per address and per account.
- Password-reset links work once, expire after one hour and sign you out everywhere.
- Sign-in and reset pages answer the same way whether or not an account exists, so they cannot be used to look up who has one.
Sessions you control
- Every signed-in device is listed in Settings, with its IP address and last activity.
- Signing a session out takes effect immediately; the server checks each session on every request.
- You are emailed when your account is used from a browser it has not seen before.
- Google and GitHub sign-in use OAuth with state and PKCE checks.
Data in transit
- The dashboard, API and short links are served over HTTPS, with HSTS and secure cookies.
- Custom domains redirect
http://visits tohttps://by default. - Every change made from the dashboard carries a CSRF token, and the dashboard API accepts same-origin requests only.
Access inside a workspace
- Four roles, Viewer, Editor, Admin and Owner, decide what each teammate can see and change.
- Role checks run on the server for every request, not just in the interface.
- Billing is visible to the owner only. Domains, API keys, webhooks and exports need an Admin.
API keys
- A key is shown once, when it is created. We keep only a SHA-256 fingerprint and a short prefix.
- The key is only used to obtain access tokens, which expire after one hour. Tokens are stored as fingerprints too.
- Revoking or regenerating a key stops it, and every token issued from it, at once.
- Requests are rate limited per key, and admins are reminded about keys unused for 90 days.
Webhooks
- Events are delivered to public HTTPS endpoints only. Private-network and localhost addresses are refused when you save the endpoint and again when each event is sent.
- Every delivery is signed with HMAC-SHA256 using a secret only you and we hold.
- Endpoints that keep failing are paused automatically and admins are told.
Your visitors' privacy
- IP addresses are not stored with clicks.
- Unique visitors are counted with a keyed token that changes every day, so it cannot follow a person over time.
- Location stops at country level, and only the referring site's host name is kept.
Payments
- Payments are processed by Stripe. Card numbers go directly to Stripe and never reach our servers.
- Billing events from Stripe are signature-checked before they change anything.
Link safety
- Destinations must be ordinary
httporhttpsaddresses. - A short link cannot point back at
lnki.ioitself, which blocks redirect loops. - Redirects are rate limited per visitor address, and are never cached by browsers.
- Our destination health checker only connects to public addresses.
How long data is kept
Records are removed automatically once they pass these ages. The periods are the same on every plan.
| Data | Kept for |
|---|---|
| Click records | 400 days |
| Filtered traffic (bots, previews) | 90 days |
| Sign-in history | 180 days |
| API request logs | 90 days |
| Webhook delivery log | 30 days |
| Data export downloads | 7 days after they are ready |
What you control
Tools in your own settings.
- Export your data as CSV and JSON from Settings › Data & Privacy.
- Review and end sessions in Settings › Security.
- Choose your alerts, including sign-in and security emails, in Settings › Notifications.
- Limit who can do what with roles in Settings › Team.
- Delete your account by contacting support.
Found a security problem?
Tell us privately before sharing it publicly. Include the steps to reproduce it and we will investigate. Please do not test against other people's accounts or links.