Security overview

This page summarises the security controls built into TrackCrown and links to the articles that explain how to use them. It describes the product as shipped; how the platform is hosted is described on the public Security page of your provider.

Encryption in transit#

• Every website, panel and tracking hostname is served over HTTPS with certificates issued automatically per domain. Plain-HTTP requests are redirected to the same address on HTTPS (308).
• The panel sends Strict-Transport-Security: max-age=31536000, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, a restrictive Permissions-Policy and Content-Security-Policy: frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'.
• Certificates of every domain are checked from the outside every hour (see Compliance probes and domain health).

Credentials#

Sign-in protection — rate limits, lockout after failed attempts, new-device e-mails, enforced two-factor authentication and single sign-on — is described in Login security.

Secrets and personal data at rest#

Fields that would be harmful if leaked are encrypted with AES-256-GCM using keys derived from the platform's APP_SECRET, each for its own purpose: taxpayer IDs of partners (only the last four digits in clear), payout provider secrets, CAPTCHA secrets and integration credentials. IP addresses in security logs (sign-ins, terms acceptances, signatures) are stored as keyed hashes.

Roles and permissions#

Every workspace member has one staff role. Higher roles include everything of the lower ones.

Partners and advertisers are not staff: they only reach their own portal, and every query there is restricted to their own records on the server — for pages, exports and the API alike. Partners never see revenue, profit, other partners or advertiser details; advertisers never see payout, profit or partner names. API keys carry the same roles and restrictions as people.

Staff can open a partner's portal read-only with View as partner.

Custom roles and limiting a manager to "their" partners or advertisers are not available.

Workspace isolation#

Every record belongs to one workspace and every query is scoped to the signed-in workspace. Reports run on a read-only analytics account with query time and size limits. Postback tokens exist per workspace and per advertiser.

Request protection#

• Server actions are protected by the framework's origin check; internal JSON routes (/api/app/*) require X-Requested-With and a same-origin Origin on every state-changing request.
• Public forms (sign-up, contact, verification) are rate limited per IP address; sign-up forms can require a CAPTCHA.
• Tracking links: transparent links only redirect to allowlisted destinations, in one step; anything else gets an error page. Fraud signals are recorded but never change a redirect. See Transparent links.

Audit trail#

Changes to offers, partners, advertisers, conversions, billing, users, keys and settings are written to the audit log. Passwords and tokens are never recorded.

Privacy controls#

• Data retention — clicks deleted after 13 months, logs purged on schedules.
• Privacy requests — GDPR/CCPA export and erasure.
• EU IP masking — store truncated IPs for European visitors.

Backups#

The reference deployment backs up the database nightly (03:17 UTC) and keeps copies for 14 days, with ClickHouse full backups every 7 days and incrementals in between. Redis counters and certificates are not backed up (they are rebuilt).

Reporting a vulnerability#

Every tracking domain serves /.well-known/security.txt, and the marketing site's Security page explains how to report a vulnerability. Abuse of tracking links is reported separately — see Abuse handling.

Related#

• Login security
• Audit log