Trust
What is encrypted, what is logged, what is never stored, and who else sees the data. Written down in enough detail to judge for yourself, because no certificate stands in for it here.
In plain English
The biggest thing on this page: your affiliates' money never passes through us, so there is no pot of other people's money here to lose. We are not SOC2 certified and we do not pretend to be. What we do instead is below, in enough detail to judge for yourself.
01 The money
Payouts are non-custodial by design. You connect your own PayPal Business, Wise Business or Payoneer credentials. We tell your PayPal or Wise account to pay, with your token to send your money to your affiliates. We never hold, receive, route or control any of it. We take 0% of it. And there is no platform-level payout credential anywhere in the system for anyone to steal.
02 No custody
Most of the harm an affiliate platform can do is to money in its custody. There is none here. It is also why your affiliates never do an identity check with us: you pay them, not us. Who holds the money sets the same question out across the category, with sources and dates.
What follows
Nothing to freeze, lose or mismanage.
Your affiliates are paid by you, not by us.
Who holds the money, across the category, on /custody.
03 No certificate
No SOC2, no ISO 27001, no audit under way. At our size the certificate would cost more than the engineering it certifies. Buying one this year would mean building less of the thing that protects your data.
If your procurement process needs SOC2 before you can sign, we are not the right supplier yet. We would rather say so now than six weeks into a questionnaire.
What we do not have
And no ISO 27001.
The certificate would cost more than the engineering it certifies.
If procurement needs SOC2 first, we are not your supplier yet.
04 Encryption
In transit: TLS everywhere, including the tracking script and the short-link redirector. At rest: the whole database, at the provider.
Twice over, for the two things that matter most. Payout credentials and tax form contents are encrypted again inside the application, under a per-deployment key. One envelope format carries a key id, so a key can be rotated without re-encrypting every row on the same day. The key is not in the database. Someone holding a copy of the database holds neither.
05 Access
06 The record
Every consequential action is recorded: who did it, what changed and when. The deletion record includes the deletion itself. That is the one entry an erasure must never be able to remove.
What is recorded
Partner approvals and commission decisions.
Payout batches.
Key creation, data exports and deletions, including the deletion itself.
07 Idempotent
Every write that moves money carries a deterministic idempotency key on a unique database index. A retry, a double click or a replayed webhook produces the same single result.
Payout methods can fail after they have accepted a request. So a payout is never marked paid because PayPal or Wise said 200. It is marked paid when the money moved.
08 Backups
The database runs on managed Postgres with a point-in-time history window of 7 days in production. Restoring means branching the database as it was at an instant. The live copy is untouched while we look at the old one.
We run a restore drill and log the result with the numbers: tables, rows, and how long end to end took. The log is short and the numbers in it are real. Calling it anything grander would be dressing it up.
The restore drill
Point-in-time history in production.
The live copy is untouched while we look at the old one.
Tables, rows, and how long end to end took.
09 Your browser
The dashboard keeps your session, which program you are looking at, and your security settings. Analytics does what you told the banner. Accept and it keeps a cookie. Refuse and it counts the visit with nothing stored in your browser at all.
Change your answer any time from Cookie choices in the footer. The privacy policy names what is stored either way.
Kept in your browser
And which program you are looking at.
Including two-factor authentication.
Refuse, and the visit is counted with nothing stored at all.
10 The recording
The part that matters on screens full of your affiliates' details does not depend on that answer. The text you click is never captured, and the session recording is fully masked: pointer, clicks and scrolling, with every text node and every input blanked before anything leaves your browser. An email address cannot be read off a recording that never held one.
11 Sub-processors
Every company that processes data on our behalf is listed at affiliaterail.com/subprocessors: what it does, where it processes, and the transfer mechanism. We give 30 days' notice before adding one. Two of them have no confirmed transfer terms yet. The page says which two, and why that does not put your data at risk.
On the list
And where it processes.
Named for each.
Before any new one is added.
12 Found something?
Email security@affiliaterail.com. Tell us what you found, how to reproduce it, and what you think it lets someone do. You get a human reply within two working days and a fix timeline within five.
Please do not open a public issue, and please do not test against data that is not yours. A test account on a trial with its own affiliates is fine. Someone else's program is not.
What you get back
A human reply.
A fix timeline.
With credit if you want it. No paid bounty.
13 Procurement
Most of what a procurement questionnaire asks is on this page, the sub-processor list and the data processing agreement, which is already in force and prints. For anything else, email support@affiliaterail.com. A person answers, usually the one who wrote the code.
The three documents
What is encrypted, what is logged, what is not stored.
Every company that touches the data.
In force, and it prints.
Gathered from above
Every line below is a claim made on this page, collected in one place.
Not stored, not held, not captured
Never held, received, routed or controlled. 0% of it is taken.
There is none anywhere in the system for anyone to steal.
Not in the database. A copy of the database holds neither.
Stored as a SHA-256 hash and shown once.
Never captured by analytics.
Every text node and every input is blanked before anything leaves your browser.
The visit is counted with nothing stored in your browser at all.
Questions
No. No SOC2, no ISO 27001, no audit under way. At our size the certificate would cost more than the engineering it certifies. If your procurement process needs SOC2 before you can sign, we are not the right supplier yet.
No. Your affiliates' money is never held, received, routed or controlled by us, and 0% of it is taken. Payouts run through your own PayPal or Wise account with your own credentials.
The database is encrypted at rest. Inside it, payout credentials and tax forms are encrypted again under a key that is not stored in the database. A copy of the database holds neither.
Every text node and every input is blanked before anything leaves your browser. Analytics never capture the text you click. If you refuse the analytics cookie, the visit is counted with nothing stored in your browser at all.
Fourteen days
No card, and 30 days to ask for your first payment back. The sub-processor list is at affiliaterail.com/subprocessors. Questions to support@affiliaterail.com, and a person answers.