Security

Last updated 26 August 2026

We are not SOC2 certified

No SOC2, no ISO 27001, no audit under way. At our size the certificate would cost more than the engineering it certifies, and buying one this year would mean building less of the thing that protects your data.

If your procurement process needs SOC2 before you can sign, we are not the right supplier yet, and we would rather say so now than six weeks into a questionnaire.

Nobody's money passes through us

Payouts are non-custodial by design. You connect your own PayPal Business, Wise Business or Payoneer credentials, and we call your rail with your token to send your money to your affiliates. We never hold, receive, route or control any of it, we take 0% of it, and there is no platform-level payout credential anywhere in the system for anyone to steal.

Most of the damage an affiliate platform can do is damage to money in its custody. There is none here to damage. It is also why your affiliates never do an identity check with us: they are being paid by you, not by us.

Encryption

• In transit: TLS everywhere, including the tracking script and the short-link redirector.
• At rest: the whole database, at the provider.
• Twice over, for the two things that matter most. Payout credentials and tax form contents are encrypted again inside the application, under a per-deployment key, in one envelope format carrying a key id so a key can be rotated without re-encrypting every row on the same day. The key is not in the database. Someone holding a copy of the database holds neither.

Access

• Two-factor authentication on accounts.
• API keys stored as a SHA-256 hash and shown once. Scopes are checked on the server, never in the page.
• Plan limits are server-side. A feature you are not on is refused by the server rather than hidden by the interface.
• One tenancy check on every query, and the isolation is tested with two customers seeded side by side rather than asserted in a document.
• Signed webhooks, with a rotated secret that keeps working for 24 hours so rotating one is not an outage.

The audit log

Every consequential action is recorded with who did it, what changed and when: approvals, commission decisions, payout batches, key creation, data exports and deletions. The deletion record includes the deletion itself, which is the one entry an erasure must never be able to remove.

Money that cannot be paid twice

Every write that moves money carries a deterministic idempotency key on a unique database index. A retry, a double click or a replayed webhook produces the same single result. Payout rails fail after they have accepted a request, so a payout is never marked paid because the rail said 200; it is marked paid when the money moved.

Backups and restore

The database runs on managed Postgres with a point-in-time history window set to 7 days in production. Restoring means branching the database as it was at an instant, so the live copy is untouched while we look at the old one.

We run a restore drill and log the result with the numbers: tables, rows, and how long end to end took. It is a young cadence with a short log rather than a decade of evidence, and calling it anything grander would be dressing it up.

What is in your browser

The dashboard keeps your session, which program you are looking at, and your security settings. Analytics runs cookieless: no cookie, no local storage, no session storage, no profile for anonymous visitors, no session replay, and no capture of the text you click, which matters because your affiliates' email addresses are on half the screens.

There is nothing here that consent law reaches, which is why you have never seen a cookie banner from us. That is a design decision, not an oversight, and the privacy policy names exactly what is stored.

Who else sees the data

Every company that processes data on our behalf is listed at affiliaterail.com/subprocessors, with what it does, where it processes and the transfer mechanism. We give 30 days' notice before adding one. Two of them have no confirmed transfer terms yet and the page says which two and why it does not put your data at risk.

Reporting a vulnerability

Email security@affiliaterail.com. Tell us what you found, how to reproduce it and what you think it lets someone do. You get a human reply within two working days and a fix timeline within five.

Please do not open a public issue, and please do not test against data that is not yours. A test account on a trial with its own affiliates is fine. Someone else's program is not.

We do not run a paid bounty. We do say thank you in public, with credit if you want it.

Answering a questionnaire

Most of what a procurement questionnaire asks is on this page, the sub-processor list and the data processing agreement, which is already in force and prints. For anything else, email support@affiliaterail.com and a person answers, usually the one who wrote the code.