Security
How we protect your program.
What we do today, stated plainly. Questions or a report: security@affiligato.com.
Infrastructure
- Cloudflare
- The app, the site and the database run on Cloudflare Workers and D1. Files sit in Cloudflare R2.
- Encrypted in transit
- Every page and API answer is served over HTTPS with HSTS. Plain HTTP is redirected.
- Strict browser policy
- Pages are served with a Content-Security-Policy that allows only our own scripts and styles.
- Secrets
- Provider keys and signing secrets are stored as Cloudflare secrets, never in code.
Accounts and access
- No passwords to leak
- Merchants and partners sign in with a link sent to their email.
- Two-factor sign-in
- Add an authenticator app for a second step on every new session.
- Roles
- Owners, admins and members. Only owners and admins change settings, payouts, integrations and the team.
- Audit log
- Who changed what, and when, for every change to a program, including changes made through the API or an AI assistant.
- Rate limits
- Sign-in and the API refuse callers that go past their limit.
Keys and webhooks
- Keys shown once
- API keys are shown once when created; we keep only their fingerprint.
- Scoped keys
- A read-only key can only read. Writes need a key made for them.
- Incoming webhooks verified
- Stripe, Paddle and PayPal signatures are checked, Chargebee and RevenueCat credentials compared in constant time, and each event applied once.
- Outgoing webhooks signed
- Every event we send carries an HMAC-SHA256 signature with a timestamp, so you can reject forgeries and replays.
Partner data and payouts
- Less data kept
- Of a tax number we keep only the last four digits. Clicks are stored without the visitor’s IP address; a signup keeps its IP address only to flag many signups from one address.
- Identity checks
- Partners verify their identity with a regulated identity provider before their first managed payout.
- Sanctions screening
- Every partner is screened against sanctions lists before every payout run.
- Licensed providers move the money
- Managed payouts are made by regulated payment providers. Affiligato’s code never holds the funds.
Report a vulnerability
Write to security@affiligato.com with what you found and how to reproduce it. We answer every report.
See also our subprocessors and privacy policy.
Launch your partner program today.
Fourteen days free, no card needed. Most programs are live in an afternoon.