Enterprise security at every step of resolution.
Security and tenant isolation are foundational to QRoute. Here is how we protect your brand reputation, your custom domains, and the millions of people scanning your physical QR codes.
100%
Tenant Isolation
TLS 1.3
HTTPS Everywhere
0 ms
Open Redirect Tolerance
< 24h
Vulnerability Response SLA
Built with defense-in-depth engineering
Every request is verified against strict security boundaries on the server before execution.
Host-First Tenant Isolation
Every incoming scan resolves the hostname to an organization ID before the slug is looked up. Foreign or nonexistent slugs always return a generic 404 — preventing cross-tenant leakage or slug enumeration attacks.
Anti-Phishing & Quishing Guard
Destinations are strictly verified on both creation and redirect. We block javascript:, data:, file:, credential-bearing URLs, and private RFC-1918 IP addresses to eliminate malicious redirects.
Cryptographic Secret Storage
Passwords hashed using bcrypt with high work factor. API secret keys are stored as one-way SHA-256 hashes and displayed in full exactly once upon creation. Secrets at rest are encrypted via AES-256.
DNS Verification & TLS Enforcement
Custom domains (e.g. go.yourbrand.com) require DNS TXT challenge verification before routing is enabled. IDNA normalization prevents homograph attacks, and TLS 1.3 is enforced with automated certificates.
Privacy-Preserving Zero-Log Scans
We never store raw scanner IP addresses or personal identifiers. Scan metrics (country, city, device type, OS) are extracted in memory and aggregated asynchronously without delaying the redirect.
Role-Based Access Control (RBAC)
Strict organization-level permissions (Owner, Admin, Editor, Viewer). Sensitive operations like domain deletions and API key rotation require elevated privileges and audit logging.
The 5-Stage Secure Redirect Lifecycle
How a scan travels from physical ink to the validated destination in under 150ms.
Edge Ingress & TLS 1.3 Handshake
The scanner's mobile device initiates an HTTPS request to the verified hostname (e.g. go.brand.com/ch4). Cloudflare & Anycast Edge terminates TLS 1.3 with Perfect Forward Secrecy (PFS), filtering volumetric DDoS attacks.
Cryptographic Tenant Scoping
The edge routing worker extracts the HTTP Host header and validates it against the verified domains directory. The request is bound to exactly one tenant ID before database query initiation.
Destination Protocol & Safety Inspection
The stored destination URL is evaluated against the safe-protocol gatekeeper. If the URL contains disallowed schemes (javascript:, data:, file:) or unverified IP destinations, the redirect is halted instantly.
Sub-150ms HTTP 302 Redirect Execution
A lightweight HTTP 302 Found response is immediately returned with strict Cache-Control headers to the camera browser. The redirect response never waits for disk writes or telemetry logs.
Asynchronous, Anonymized Telemetry
An edge background task aggregates geographic region and user-agent details into an encrypted queue. IP addresses are salted and discarded in memory, ensuring full GDPR and DPDP compliance.
Protecting your brand against QR Phishing (“Quishing”)
Malicious actors frequently abuse generic short-URL services to redirect unsuspecting users to phishing sites. QRoute implements multi-stage destination allowlists and cryptographic organization scoping to ensure your QR codes can never be hijacked for malicious redirects.
- Strict protocol verification: Only https:// destinations allowed
- Blocklist for credential-harvesting, unverified IP addresses, and dark web links
- Zero redirect parameter manipulation via query string tampering
- Automated SSL certificate verification on all verified custom domains
All destination checks are enforced at resolution time.
Enterprise Threat Matrix & Defenses
How QRoute mathematically neutralizes common print and QR attack vectors.
| Threat Vector | Attack Mechanism | QRoute Countermeasure |
|---|---|---|
| Quishing & Phishing Redirection | Bad actor tries to update a printed QR code to point to a credential-harvesting scam site. | Multi-layered protocol allowlists, real-time threat feed lookups, and strict HTTPS enforcement prevent malicious target URLs. |
| Cross-Tenant Slug Hijacking | An external tenant tries to guess or resolve slugs belonging to another brand or publisher. | Tenant-isolated lookup requires matching host domain + Organization ID. Foreign slugs yield a generic 404 with zero metadata leakage. |
| Homograph Domain Spoofing | Attacker registers lookalike Unicode domain (e.g. gо.brand.com with Cyrillic 'о'). | Automated IDNA / Punycode normalization and strict DNS TXT verification token ownership checks before domain provisioning. |
| Redirect Latency & Denial of Service | High-volume scan spike (e.g. national TV broadcast or concert event) overwhelms redirect servers. | Decoupled edge architecture with in-memory Redis caching handles 50,000+ requests/sec with under 150ms latency. |
| API Key Theft & Compromise | Exposed API key in client-side code used to manipulate enterprise redirect destinations. | One-way SHA-256 hashing on storage, granular IP allowlisting for API requests, and instant one-click key revocation. |
Data Encryption & Storage Standards
Industry-standard cryptographic primitives protecting your data at every state.
Data in Transit
TLS 1.3 enforced on all HTTP endpoints with HSTS (1-year preloaded) and Perfect Forward Secrecy (PFS).
Data at Rest
Databases and object stores encrypted via AES-256 with automated hardware security module (HSM) key rotation.
Credential Hashing
User passwords hashed with Bcrypt (cost factor 12). API keys hashed with one-way SHA-256 digests.
PII Masking
IP addresses salted in volatile RAM and immediately discarded. Never stored in disk logs or query history.
Privacy-first compliance standards
We never monetize, harvest, or sell scanner data.
GDPR & Privacy Aligned
No third-party tracking cookies on redirect endpoints. Full support for data subject export and deletion requests.
DPDP Act (India) Ready
Compliant with India's Digital Personal Data Protection Act requirements for data minimization and purpose limitation.
WCAG 2.2 AA Contrast
Built-in automated contrast validation prevents generating QR codes that fail camera scan verification or accessibility audits.
OWASP Top 10 Defenses
Continuous automated scanning for SSRF, SQL injection, XSS, rate-limit bypassing, and open redirect vulnerabilities.
Frequently Asked Security Questions
Common questions answered for security reviewers and compliance teams.
How does QRoute ensure 99.95% uptime for printed dynamic QR codes?
Our redirect engine operates independently of our web dashboard. Redirects are executed by distributed edge nodes across multiple global regions with automated multi-cloud failover. Even if our dashboard undergoes maintenance, printed QR code redirects remain 100% operational.
Does QRoute store personally identifiable information (PII) of people who scan codes?
No. We believe in privacy by design. When a user scans a code, we extract coarse geo-location (country and city) and device category (iOS/Android/Desktop) entirely in memory. Raw IP addresses and precise GPS coordinates are never logged or stored in our database.
How are custom domain SSL/TLS certificates handled and renewed?
Once you add your custom domain (such as go.yourbrand.com) and verify DNS TXT ownership, QRoute automatically provisions a dedicated TLS 1.3 certificate. Certificates are automatically renewed 30 days before expiration with zero downtime or manual intervention.
Can team members with viewer access modify destination links?
No. QRoute enforces strict Role-Based Access Control (RBAC). Only users with 'Owner', 'Admin', or 'Editor' permissions can create or edit dynamic QR destinations. 'Viewers' can only inspect scan analytics and download pre-generated assets.
What is your backup and disaster recovery policy (RPO & RTO)?
We perform automated point-in-time database backups every hour with multi-region replication. Our Recovery Point Objective (RPO) is under 1 hour, and our Recovery Time Objective (RTO) is under 15 minutes.
Responsible Vulnerability Disclosure
We take security reports with the highest priority.
If you believe you have found a security vulnerability in QRoute, we appreciate your help in disclosing it to us responsibly. We investigate all legitimate reports and commit to resolving verified issues quickly.
Primary Security Email: support@qroute.in
Response Time: Initial acknowledgment within 24 hours.
Safe Harbor: We will not pursue legal action against researchers acting in good faith according to responsible disclosure guidelines.