---
title: "Security and GDPR"
description: "Where Linkbreakers hosts your data, how it is encrypted and protected, what a QR code scan records, how long data is kept, every subprocessor we use, and how to get a Data Processing Agreement."
canonical: "https://linkbreakers.com/security"
last-updated: 2026-10-31
---

# Security and GDPR

> Where Linkbreakers hosts your data, how it is encrypted and protected, what a QR code scan records, how long data is kept, every subprocessor we use, and how to get a Data Processing Agreement.

## Short answer

- **GDPR:** Linkbreakers is a French company and complies with the GDPR. We are the **processor** for the data your visitors leave when they scan your QR codes or open your links, and the **controller** for your account data. Our supervisory authority is the CNIL.
- **Where data lives:** in the United States. The application runs on DigitalOcean in San Francisco and the database on CockroachDB Cloud in Google Cloud's Los Angeles region. Transfers out of the EU rely on the EU-US Data Privacy Framework and the Standard Contractual Clauses, depending on the provider (see [Subprocessors](#subprocessors)).
- **Encryption:** every domain is served over HTTPS, the database connection uses TLS with certificate verification, and data at rest is encrypted by our storage providers.
- **DPA:** a Data Processing Agreement is available on request at [support@linkbreakers.com](mailto:support@linkbreakers.com).
- **Certifications:** Linkbreakers is **not** SOC 2 or ISO 27001 certified. This page describes what we do instead, in enough detail for a security review.

## Who is responsible for what

Linkbreakers is a French private company (registration number 531 252 252), located at 30B Rue de l'Or, 33470 Gujan-Mestras, France.

| Data | Controller | Linkbreakers' role |
|---|---|---|
| Your visitors: scans, device details, form answers | You, the customer who created the link | Processor, acting on your instructions |
| Your account and the members of your workspace | Linkbreakers | Controller |
| People browsing linkbreakers.com | Linkbreakers | Controller |

The [Privacy Statement](/privacy) is the full legal description of what we collect and why. This page explains how that data is protected.

## Infrastructure and hosting

| Component | Provider | Region |
|---|---|---|
| Website, dashboard (app.linkbreakers.com) | DigitalOcean App Platform | San Francisco, United States |
| API, MCP server and the scan service | DigitalOcean Kubernetes | San Francisco (sfo3), United States |
| Main database | CockroachDB Cloud, on Google Cloud | us-west2 (Los Angeles), United States |
| Cache and background job queue | Redis Cloud, on AWS | us-west-1 (Northern California), United States |
| Media files and QR code images | Cloudflare R2 | Western North America |
| DNS, TLS and network for every domain | Cloudflare | Cloudflare's global network |
| Logs and metrics | Grafana Cloud | United States (us-west) |

There is no EU data residency option today. All customer data is stored in the United States.

**Backups.** Cockroach Labs takes managed backups of every CockroachDB Cloud cluster by default. On Google Cloud clusters these backups are encrypted at rest with Google-managed keys ([Cockroach Labs security overview](https://docs.cockroachlabs.com/docs/cockroachcloud/security-overview), [managed backups](https://docs.cockroachlabs.com/docs/cockroachcloud/managed-backups)).

## Encryption

**In transit**

- linkbreakers.com, app.linkbreakers.com, the API, the MCP server and the short link domain are all served over HTTPS through Cloudflare. The website and the API send an HTTP Strict Transport Security (HSTS) header valid for one year, including subdomains.
- When you connect a custom domain for your QR codes, a TLS certificate is issued for it through Cloudflare, so your branded links are served over HTTPS too.
- The connection from our servers to the database uses TLS with full certificate verification (`verify-full`).

**At rest**

- The database is encrypted at rest at the infrastructure level by Google Cloud, as CockroachDB Cloud does for every cluster ([source](https://docs.cockroachlabs.com/docs/cockroachcloud/security-overview)).
- Media and QR code images stored in Cloudflare R2 are encrypted at rest with AES-256 ([source](https://developers.cloudflare.com/r2/reference/data-security/)).
- On top of that, the credentials of the integrations you connect (Slack, Google Forms and Google Analytics) are encrypted by Linkbreakers itself with AES-256-GCM before they are stored.
- Passwords are never stored in readable form, only as bcrypt hashes.

## Accounts and access

**Sign-in.** You sign in with an email and password, or with your Google or Microsoft account through Google Firebase Authentication. With Google or Microsoft, we never see or store a password. Email addresses are verified, and a workspace that does not verify its email within 7 days is paused.

**Multi-factor authentication.** A workspace can **require** multi-factor authentication for every member in its settings. Members then confirm each sign-in with a 6-digit code sent by email, valid for 15 minutes. The requirement also applies when a member switches into the workspace and when an AI agent asks to connect to it through the MCP server.

**Roles.** Each member of a workspace has a role:

- **Admin:** full access to the workspace, including billing.
- **Viewer:** read-only access to the dashboard and links, and no access to billing.

**Sessions.** Dashboard sessions use signed tokens that can be revoked. Sessions that have not been used for 14 days are deleted.

**API tokens.** API tokens belong to one workspace. You can create several, see when each was last used, and revoke any of them at any time; a revoked token stops working within 30 seconds. The API is rate limited per token and per IP address.

**AI agents and the MCP server.** AI assistants such as Claude or ChatGPT connect to the [Linkbreakers MCP server](/mcp) with OAuth: the authorization code flow with PKCE (S256 only), dynamic client registration and token revocation. You approve each connection yourself, and registered clients that are never used are removed after 30 days. API tokens also work for agents that cannot use OAuth.

**Link safety.** Every link destination is checked with Google Safe Browsing, and links to known phishing or malware destinations are blocked.

**Monitoring.** Errors in the API and dashboard are reported to Sentry, and request logs and infrastructure metrics go to Grafana Cloud, where alerts notify us of failures.

## What a scan records

Each customer chooses a **data collection level** for the workspace or for each link: None, Basic or Advanced. The level decides what is stored when someone scans a QR code or opens a link.

| Data | None | Basic | Advanced |
|---|---|---|---|
| Time of the scan, link, destination, workflow steps completed | Yes | Yes | Yes |
| IP address (stored in full) | No | Yes | Yes |
| Device type, brand and model, browser and operating system, language, timezone | No | Yes | Yes |
| Country, region and city, network provider (derived from the IP address) | No | Yes | Yes |
| Screen size, graphics card, memory, processor cores, touch support, network information | No | No | Yes |
| Answers the visitor types into your forms | When your workflow asks for them | When your workflow asks for them | When your workflow asks for them |

**Location from the IP address** is computed with a MaxMind GeoLite2 database that runs on our own servers, so visitors' IP addresses are never sent to MaxMind or any other geolocation service. It gives a country, region and city, never a precise position.

**Precise location (GPS) is never collected without consent.** It is only requested when a customer adds a [Location request](/help/article/how-to-ask-for-a-visitors-precise-location) step to a link. The visitor's browser then asks for permission, and only if the visitor accepts do we record the latitude, longitude and accuracy their device reports. Visitors can refuse, skip the step, or withdraw the permission later in their browser settings.

**Device identifiers are separate for each workspace.** A visitor's device identifier is derived per workspace with a keyed hash (HMAC-SHA256), so two customers whose QR codes are scanned by the same phone see two unrelated identifiers.

**Cookies on scan pages.** Linkbreakers sets one cookie on links and QR codes, `linkbreakers.browser`. It holds a random value, is HttpOnly and first-party, lasts one year, and lets the customer's analytics recognize a returning browser. It is not used for advertising. If a customer adds a [retargeting pixel](/help/article/retargeting-pixels-meta-google-tiktok-linkedin-and-google-tag-manager) (Meta, Google, TikTok or LinkedIn) to a link, that platform's script sets its own marketing cookies; collecting consent for them is the customer's responsibility.

We do not sell personal data, and we do not use your visitors' data for our own advertising.

## Retention and deletion

- **Your data is kept as long as your workspace exists.** Linkbreakers does not delete scan data on a timer; you decide how long to keep it.
- **Deleting a workspace** removes its links, media, members, events, visitors and devices. An hourly job permanently deletes them after you delete the workspace. If the workspace has a subscription, deletion happens once the subscription ends.
- **Deleting a visitor** removes their profile and the attributes they gave you, in the dashboard or through the API. Their scan events stay in your analytics, no longer linked to the profile.
- **Expiring links** delete the link and its analytics when they expire.
- **Unused workspaces are cleaned up:** a free workspace that has no email address after 7 days, or that never verified its email and never received a visit after 21 days, has its data deleted. A workspace created by an AI agent and not claimed within 24 hours is cleaned up the same way.
- **Backups** held by our database provider can contain deleted data until they expire.

**Export.** You can export events and visitors as CSV from the dashboard, or read them as JSON or CSV through the [API](/help/api).

## Your GDPR rights

**For your account data** (where Linkbreakers is the controller), you can access, correct, delete, restrict or object to the processing of your data, receive it in a portable format, and withdraw consent where we rely on it. Most of it can be changed in the dashboard, and you can delete your workspace yourself. For anything else, write to [support@linkbreakers.com](mailto:support@linkbreakers.com). You can also complain to the CNIL ([cnil.fr](https://www.cnil.fr)).

**For your visitors' data** (where you are the controller), the dashboard and the API give you what you need to answer their requests:

| Visitor's request | How to handle it |
|---|---|
| Access or portability | Export their events and profile as CSV, or read them through the API |
| Rectification | Edit the visitor's attributes in the dashboard or through the API |
| Erasure | Delete the visitor's profile in the dashboard or through the API |
| Objection or restriction | Lower the data collection level, which applies to future scans |

If one of your visitors writes to us instead of you, we forward the request to you. The article [What is GDPR and how does Linkbreakers handle it?](/help/article/what-is-gdpr-and-how-does-linkbreakers-handle-it) explains what stays your responsibility as the controller.

## Data Processing Agreement

A Data Processing Agreement (DPA) under Article 28 of the GDPR is available on request. Write to [support@linkbreakers.com](mailto:support@linkbreakers.com) with your company's legal name and address, and we send it to you for signature.

<a id="subprocessors" style="display:block;scroll-margin-top:96px"></a>

## Subprocessors

These providers process personal data on our behalf. "Transfer safeguard" is how a transfer from the EU to that provider is covered: the [EU-US Data Privacy Framework](https://www.dataprivacyframework.gov/) (DPF) where the provider is an active participant, and the Standard Contractual Clauses (SCCs) where the provider's data processing agreement includes them.

| Provider | What it does for us | Data it handles | Location | Transfer safeguard |
|---|---|---|---|---|
| DigitalOcean | Hosts the website, dashboard, API and scan service | All application data while it is processed | United States (San Francisco) | DPF, SCCs |
| Cockroach Labs, on Google Cloud | Main database | Account, workspace, link and visitor data | United States (Los Angeles) | DPF, SCCs |
| Redis (Redis Cloud), on AWS | Cache and background job queue | Short-lived copies of application data | United States (Northern California) | SCCs |
| Cloudflare | DNS, TLS and network for every domain, certificates for custom domains, storage of media and QR code images (R2) | Network traffic including IP addresses, uploaded files | Global network; storage in North America | DPF, SCCs |
| Grafana Labs | Logs, metrics and alerting | Request logs, which can include IP addresses | United States | DPF, SCCs |
| Sentry | Error monitoring for the API and dashboard | Error reports, which can include user identifiers | United States | DPF, SCCs |
| Google Firebase | Sign-in with Google or Microsoft | Email address, name, sign-in identifier | United States | DPF, SCCs |
| Google Safe Browsing | Checks link destinations for phishing and malware | Destination URLs of links | United States | DPF |
| Stripe | Payments and subscriptions | Billing details; card details are held by Stripe only | Stripe Payments Europe (Ireland), with transfers to Stripe in the United States | DPF, SCCs |
| Postmark | Service emails, such as verification and sign-in codes | Email address, name, email content | United States | DPF, SCCs |
| Mixpanel | Product analytics | Account identifiers and product usage events | United States | DPF, SCCs |
| PostHog | Product analytics and session recordings with form fields masked, only after consent in the EU, EEA, UK and Switzerland | Usage of the website and dashboard | United States | DPF, SCCs |
| Plausible | Cookieless website analytics for linkbreakers.com | Page visits, without cookies | European Union (Germany) | No transfer outside the EU |
| HubSpot | Customer records | Customer contact and workspace details | United States | DPF, SCCs |
| Help Scout | Support conversations | Support messages and email address | United States | DPF, SCCs |
| Slack | Internal notifications, and copies of Assistant conversations our team reviews to improve it | Assistant conversations and internal notifications about workspaces | United States | DPF, SCCs |
| OpenRouter | Forwards Assistant requests to AI model providers (OpenAI and Google), set to use only providers that do not collect prompts | Assistant messages and the workspace context they need | United States | SCCs |
| OpenAI | Summarizes the free-text answers visitors give to a customer's forms | Visitors' form answers | United States (OpenAI Ireland is the contracting entity for EU customers) | SCCs |
| Meta | Measures Linkbreakers' own advertising | Sign-up events and a hashed (unreadable) email address | Meta Platforms Ireland, with transfers to the United States | DPF |

Customers can also connect their own integrations, such as Slack, Google Forms, webhooks, Zapier or Make. Data sent to those tools goes on the customer's instructions and is not covered by this list.

## Incidents and responsible disclosure

**If a breach affects your data,** we inform affected customers without undue delay, with what happened, what data is concerned and what we are doing about it, so you can meet your own obligations as a controller. For data where Linkbreakers is the controller, we notify the CNIL within 72 hours as Article 33 of the GDPR requires.

<a id="responsible-disclosure" style="display:block;scroll-margin-top:96px"></a>

**Reporting a vulnerability.** If you find a security issue in Linkbreakers, email [support@linkbreakers.com](mailto:support@linkbreakers.com) with the steps to reproduce it. Please give us reasonable time to fix it before making it public, and do not access or change other customers' data while testing. The same contact is published in our [security.txt](/.well-known/security.txt). We do not run a paid bug bounty program.

## Frequently asked questions

### Is Linkbreakers GDPR compliant?

Yes. Linkbreakers is a French company and complies with the GDPR as a processor for the data of the people who scan your QR codes and as a controller for your account data. You get per-link data collection levels, consent-based precise location, CSV export and visitor deletion to answer your visitors' requests, and a Data Processing Agreement on request.

### Where is my data stored?

In the United States. The application runs on DigitalOcean in San Francisco, the database on CockroachDB Cloud in Google Cloud's Los Angeles region, and media files on Cloudflare R2 in North America. There is no EU data residency option. Transfers from the EU rely on the EU-US Data Privacy Framework and the Standard Contractual Clauses.

### Is Linkbreakers SOC 2 or ISO 27001 certified?

No. Linkbreakers is not SOC 2 or ISO 27001 certified. Instead, this page documents our hosting, encryption, access controls, retention and subprocessors so your team can review them, and our infrastructure providers (DigitalOcean, Cockroach Labs, Google Cloud and Cloudflare) publish their own certifications.

### Can I sign a Data Processing Agreement?

Yes. Email support@linkbreakers.com with your company's legal name and address, and we send you a DPA under Article 28 of the GDPR.

### Is tracking the location of QR code scans GDPR compliant?

It can be, if you have a lawful basis and inform your visitors. By default Linkbreakers only derives an approximate location (country, region, city) from the IP address, on our own servers. Precise GPS location is only recorded when you add a Location request step and the visitor accepts the browser's permission prompt. Choose the None data collection level if you only need scan counts.

### Do QR code scans set cookies?

Yes, one: the first-party `linkbreakers.browser` cookie, which holds a random value, lasts one year and lets your analytics recognize a returning browser. It is not used for advertising. Marketing cookies are only set if you add a retargeting pixel to the link yourself.

### Do you use my visitors' data for advertising or AI training?

No. We do not sell personal data or use your visitors' data for our own advertising. The Assistant goes through OpenRouter configured to use only AI providers that do not collect prompts.

### How do I delete my data?

Delete a visitor's profile from the dashboard or the API, or delete your whole workspace from its settings: its links, media, members, events and visitors are then permanently deleted. For anything else, write to support@linkbreakers.com.

Last updated: 2026-10-31 by Laurent Schaffner

---

Source: https://linkbreakers.com/security