Trust

Audits

Sporetag does not have a SOC 2 report yet. When we have one, this page will name it, with the firm that audited us and the period it covers. Until then, this page and the pages it links to say what we do today.

Status now

Everything is working. Checked Nov 1, 2:15 AM UTC, every 15 minutes.

• Tracking: Working, 96.64% up since Oct 23, 2026
• Short links: Working, 100.00% up since Oct 23, 2026
• Dashboard and stats: Working, 100.00% up since Oct 23, 2026
• Email: Working, 100.00% up since Oct 23, 2026
• Billing: Working, 100.00% up since Oct 23, 2026
• Background jobs: Working, 100.00% up since Oct 23, 2026

History and incidents are on the status page.

How we protect data

• Every page and API is served over HTTPS, with HSTS for a year.
• Passwords are hashed with PBKDF2. Session tokens are stored only as hashes.
• Our admins must use two-step sign-in, and their sessions end 12 hours after they sign in.
• Every admin action and admin page is written to a log in which each entry is sealed to the one before it, so a changed entry shows.
• Tokens for the tools you connect, and contact details in customer profiles, are encrypted with AES-GCM.
• Visitor IP addresses are never stored.

The full list is on the security page.

Retention and backups

• The database is copied to a private bucket every night after 03:00 UTC. Each night's copy is kept 30 days, and the first copy of each month for 12 months.
• Once a month, from day 1, the newest copy is read back and every row count and checksum is checked. A failed check emails us.
• Cloudflare also keeps 30 days of point-in-time history, so we can rewind the database to any minute in that window.
• Sign-in sessions last up to 30 days. The account activity log keeps 90 days.

Every period, for every kind of data, is on Data, retention and backups.

Subprocessors

These companies help us run Sporetag. What each receives and when is on Data, retention and backups. We email account holders before we add one.

• Cloudflare
• Stripe
• Anthropic
• Twilio
• Amazon Web Services
• Google Safe Browsing
• Meta, for our own ads
• Have I Been Pwned
• Google, GitHub
• Apple, Google, Mozilla and Microsoft push services

Documents

• Our data processing agreement. It is a draft until a lawyer reviews it.
• Our privacy policy and terms.
• For your security questionnaire, email hello@sporetag.com.

Report a problem

Email hello@sporetag.com. Our contact details for security reports are in security.txt.