# Security What we do to protect your data, what we don't do, and how to report a vulnerability. We're a small company. We hold things that matter to people who aren't our customers: your affiliates' payout details and tax forms. We also hold your own payout method credentials. This page says what protects them, and where we don't do something, it says that too. ## We aren't SOC2 certified SOC2 and ISO 27001 are security certificates an outside auditor signs off. We don't hold either, or any other certification, and we don't have an audit under way. At our size the certificate would cost more than the engineering it checks. Instead, this page describes what we do in enough detail for you to judge it yourself. If your procurement process needs SOC2 before you sign, we aren't the right supplier. We'd rather tell you now. ## Your affiliates' money never touches us Payouts are non-custodial by design, which means we never hold the money. You connect your own PayPal Business or Wise Business credentials. We tell your PayPal or Wise account to pay, using your token, and the money goes from you to your affiliates. - We never hold, receive, route or control any of it. - We charge nothing on it. - There's no platform-level payout credential anywhere in the system to be stolen. Most of the damage an affiliate platform can do is to money in its custody. We have none. ## Encryption - **In transit**: TLS on every surface, including the tracker and the short-link redirector. - **At rest**: the whole database, at the provider. - **Twice over for the two secrets that matter.** Payout credentials and tax form payloads are encrypted a second time in the application, under a per-deployment key. - **One envelope format, with a key id.** A key can be rotated without re-encrypting every row on the same day. - **The key isn't in the database.** Someone with a copy of the database has neither. ## Access - **Scoped API keys.** Each key only does what its scopes allow. We store a SHA-256 hash of it and show it once. The server enforces scopes, never the interface. - **Three team roles** (owner, admin and member). The server checks the role on every action that moves money, holds a credential or changes the team. [Who can do what](/guides/account-security#who-on-your-team-can-do-what). - **Two-factor authentication** on merchant accounts. - **Server-side plan gates.** If your plan doesn't include a feature, the server refuses it. - **One tenancy check on every query.** Programs can't see each other. We test that with two tenants seeded side by side. - **Signed webhooks** (`Rail-Signature`). When you rotate the secret, the old one keeps working for 24 hours, so a rotation doesn't cause an outage. ## The audit log The log records every action with consequences: who did it, what changed, and when. That covers approvals, commission decisions, payout batches, key creation, data exports and deletions. A deletion gets its own record too. An erasure must never be able to remove that entry. ## Backups and restore The database runs on Neon. Neon keeps a point-in-time history window, set to **7 days** in production. To restore, we branch the database as it was at a set moment. The live copy stays untouched while we look. We run a restore drill and log the result with the numbers: tables, rows, and how long the whole restore took. The drill has been run, and its log lives in the repository. The routine is young, so there's no long track record behind it. ## Analytics, and what's in your browser Since August 2026 the product's analytics runs cookieless: - no cookies, local storage or session storage - no profile for anonymous traffic - session replay off - autocapture off, so no text you click leaves the browser, including an affiliate's email address The dashboard keeps only what it needs to work in your browser: your session, which program you're looking at, and your security settings. None of that falls under consent law, which is why there's no cookie banner. ## Who else sees the data A sub-processor is another company that handles data for us. The current list is published at [affiliaterail.com/subprocessors](https://affiliaterail.com/subprocessors). It says what each one does, where it processes data and under which transfer mechanism. We commit to announcing a change before it takes effect. ## Reporting a vulnerability Email **security@affiliaterail.com**. Tell us: - what you found - how to reproduce it - what you think it lets someone do You'll get a human reply within two working days and a fix timeline within five. Please don't open a public issue, and please don't test against data that isn't yours. A test merchant on a trial with its own partners is fine. Someone else's program isn't. We don't run a paid bounty. We do say thank you in public, with credit if you want it.