Security

Security is built into TRIMS at every layer — not bolted on afterward. We combine strong encryption, least-privilege access, continuous monitoring, and automated abuse protection to keep your links, analytics, and customer data safe.

This page describes the technical and organizational measures we use. If you have a specific security question or need documentation for a vendor review, contact info@trims.app.

• In transit — all traffic is encrypted with TLS 1.3. HSTS is enforced and insecure protocols are disabled.
• At rest — sensitive fields are encrypted with AES-256. Databases and backups are encrypted at the storage layer.
• Passwords — never stored in plaintext; they are hashed with a modern, salted, memory-hard algorithm.
• Secrets — API tokens and integration credentials are stored encrypted and shown only once at creation.
• Custom domains — every domain you connect receives an automatically managed SSL certificate.

• Two-factor authentication — TOTP-based 2FA with one-time recovery codes.
• Session security — signed, HTTP-only session cookies with CSRF protection; you can view and revoke active sessions.
• Role-based access control — Owner, Admin, Editor, and Viewer roles scope what each member can do in a workspace.
• Scoped API tokens — tokens carry least-privilege scopes and are bound to a single workspace.
• Two-factor authentication — TOTP with an authenticator app, single-use recovery codes, and step-up re-authentication for sensitive operator actions.
• Tenant isolation — every query is scoped to the authorized workspace to prevent cross-tenant access.

• Input validation and parameterized queries to prevent injection attacks.
• Output encoding and a strict Content Security Policy to mitigate XSS.
• Anti-CSRF tokens on state-changing requests.
• Rate limiting on authentication and sensitive endpoints to blunt brute-force and abuse.
• Security headers including X-Content-Type-Options, X-Frame-Options, and Content-Security-Policy.
• SSRF and dangerous-URL protections on destinations and integrations.
• Dependency scanning and prompt patching of known vulnerabilities.

The Services run on hardened cloud infrastructure with defense-in-depth networking.

• Global edge for low-latency redirects with DDoS protection at the network edge.
• Private networking between application and data tiers; databases are not publicly exposed.
• Least-privilege infrastructure access, protected by strong authentication and audited.
• Encrypted, regularly tested backups with defined recovery objectives.

Because short links can be a vector for abuse, we protect both link owners and end users:

• Malware scanning — destinations are checked so your brand never fronts a malicious link.
• Bot & VPN detection — automated and anonymized traffic is flagged so your analytics stay honest.
• Rate limits & quotas — protect the platform from spam and enumeration.
• Interstitial warnings — suspected malicious links show a warning before redirecting.

• Every privileged workspace action — invites, role changes, deletions, token creation — is recorded in a timestamped, searchable audit log (Premium).
• API requests are logged per token for traceability.
• Application and infrastructure metrics are monitored with alerting on anomalies.

We collect the minimum data needed to operate the Services, truncate or hash IP addresses after use, and retain analytics per your plan's window. See our Privacy Policy and GDPR pages for full detail.

We welcome reports from security researchers. If you believe you've found a vulnerability:

• Email info@trims.app with details and reproduction steps.
• Give us reasonable time to investigate and remediate before public disclosure.
• Do not access or modify other users' data, degrade the Services, or run automated scans that cause harm.

We will acknowledge your report, keep you updated, and credit good-faith researchers where appropriate.

We maintain an incident-response process to detect, contain, and remediate security events. In the event of a breach affecting your personal data, we will notify affected customers and, where required, regulators within the timeframes mandated by applicable law.

Our controls are designed to align with recognized frameworks and privacy laws:

• Use a strong, unique password and enable two-factor authentication.
• Grant workspace roles on a least-privilege basis and review members periodically.
• Keep API tokens server-side and rotate them if exposed.
• Report suspicious activity to us promptly.

Security questions or reports: info@trims.app.