Security

We are a small company holding things that matter to people who are not our customers: your affiliates' payout details and tax forms, and your own payment-rail credentials. This page says what protects them. Where we do not do something, it says that too, because an honest answer is the only one that survives a procurement questionnaire.

We are not SOC2 certified

We do not hold SOC2, ISO 27001 or any other certification, and we do not have an audit under way. At our size the certificate would cost more than the engineering it certifies. What we do instead is on this page, in enough detail that you can judge it yourself rather than trust a badge.

If your procurement process requires SOC2 to sign, we are not the right supplier yet, and we would rather tell you now.

Your affiliates' money never touches us

Payouts are non-custodial by design. You connect your own PayPal Business or Wise Business credentials, and we call your rail with your token to move your money to your affiliates. We never hold, receive, route or control any of it, we charge nothing on it, and there is no platform-level payout credential anywhere in the system to be stolen.

This is the single largest thing on this page. Most of the damage an affiliate platform can do is damage to money in its custody, and there is none.

Encryption

• In transit: TLS on every surface, including the tracker and the short-link redirector.
• At rest: the whole database, at the provider.
• Twice over for the two secrets that matter. Payout credentials and tax form payloads are encrypted a second time in the application, under a per-deployment key, in one envelope format with a key id so a key can be rotated without re-encrypting every row on the same day. The key is not in the database. Someone with a copy of the database has neither.

Access

• Scoped API keys, stored as a SHA-256 hash and shown once. Scopes are enforced on the server, never in the interface.
• Two-factor authentication on merchant accounts.
• Server-side plan gates. A feature you are not on is refused by the server, not hidden by the page.
• One tenancy predicate on every query. Programs cannot see each other, and the isolation is tested with two tenants seeded side by side rather than asserted.
• Signed webhooks (Rail-Signature), with a rotated secret that keeps working for 24 hours so a rotation does not become an outage.

The audit log

Every consequential action is recorded with who did it, what changed, and when: approvals, commission decisions, payout batches, key creation, data exports and deletions. The deletion record includes the deletion itself, which is the one entry an erasure must never be able to remove.

Backups and restore

The database runs on Neon with a point-in-time history window, set to 7 days in production. Restoring means branching the database as it was at an instant, so the live copy is untouched while we look.

We run a restore drill and log the result with the numbers: tables, rows and how long the end to end took. The drill has been run and its log lives in the repository. It is a young cadence rather than a long track record, and calling it anything else would be dressing it up.

Analytics, and what is in your browser

Since August 2026 the product's analytics runs cookieless: no cookies, no local storage, no session storage, and no profile for anonymous traffic. Session replay is off. Autocapture is off, so no text you click, including an affiliate's email address, ever leaves the browser.

The only things the dashboard keeps in your browser are the ones that make it work: your session, which program you are looking at, and your security settings. There is nothing here that consent law reaches, which is why you do not see a cookie banner.

Who else sees the data

The current sub-processor list, what each one does, where it processes and under which transfer mechanism, is published at affiliaterail.com/subprocessors. We commit to announcing a change before it takes effect.

Reporting a vulnerability

Email security@affiliaterail.com. Tell us what you found, how to reproduce it and what you think it lets someone do. You will get a human reply within two working days and a fix timeline within five.

Please do not open a public issue, and please do not test against data that is not yours. A test merchant on a trial with its own partners is fine. Someone else's program is not.

We do not run a paid bounty. We do say thank you in public, with credit if you want it.