Security, by default.

Our Security Commitment

Security is part of how Routo is built, not a bolt-on. The practices below describe what we do today, what we're working toward, and what we won't claim until it's audited.

Compliance and Certifications

We're pursuing third-party certification while running the security practices listed under"Current Security Practices" today.

Security Standards (In Progress)

Audits and certifications underway:

• SOC 2 Type II: In progress (7-11 month timeline) - third-party audit of security controls
• ISO 27001: In progress (9-13 months) - information security management system certification
• GDPR Compliance: In progress (5-7 months) - European data protection standards
• CCPA Compliance: In progress (4-6 months) - California privacy requirements

Current Security Practices

In place today, regardless of certification status:

• Documented security policies and procedures
• Incident response and disaster recovery plans
• Comprehensive risk assessment and management
• Regular security audits and reviews
• Employee security training and awareness
• Continuous improvement processes

Privacy Protection

We build with privacy-first principles aligned with GDPR and CCPA requirements:

• Data protection by design and default
• Right to access, rectification, and erasure
• Data portability and processing transparency
• Clear disclosure of data collection practices
• Data deletion rights on request
• We never sell your data to third parties

Data Protection

Encryption

Your data is protected with encryption at every stage:

• In Transit: All data transmitted to and from Routo is encrypted using TLS 1.3, the latest and most secure transport layer security protocol
• At Rest: All stored data is encrypted using AES-256 encryption, the same standard used by governments and financial institutions
• Database Encryption: Our database provider (Turso) encrypts all data at rest with AES-256
• Backup Encryption: All backups are encrypted with the same standards as production data

Password Security

• Hashing: Passwords are hashed using bcrypt with unique salts, making them unreadable even to us
• Password Requirements: Strong password policies enforced at account creation
• Multi-Factor Authentication: Available for all accounts for an additional layer of security
• Secure Password Reset: Time-limited, single-use reset tokens

API Security

• Secure Key Generation: API keys use cryptographically secure random generation
• Key Rotation: Support for regular API key rotation
• Scope Limitations: Fine-grained permissions for API access
• Rate Limiting: Protection against abuse and brute-force attacks

Infrastructure Security

Geographic Distribution

Our infrastructure is distributed globally for reliability and performance:

• Edge-routed worldwide: Powered by Cloudflare Workers, serving requests from the nearest available location to your users
• Multi-Region Database: Hosted on Turso (libsql) with automatic failover capabilities
• Distributed Caching: Cloudflare KV stores replicated globally
• No Single Points of Failure: Redundant systems at every layer

DDoS Protection

• Cloudflare DDoS Protection: Automatic mitigation of distributed denial-of-service attacks
• Rate Limiting: Intelligent rate limiting at the edge
• Bot Management: Advanced bot detection and mitigation
• Always Online: Cached content served even during attacks

Network Security

• Firewall Protection: Network-level security controls
• IP Allowlisting: Available for Enterprise customers
• VPC Isolation: Isolated database networks
• Security Groups: Granular network access controls

Access Controls

Authentication and Authorization

• Better Auth Integration: Secure, modern authentication infrastructure
• OAuth Support: Sign in with Google, GitHub, or other providers
• Session Management: Secure, time-limited sessions with automatic expiration
• Role-Based Access Control: Fine-grained permissions for team members

Team Permissions

• Least Privilege Principle: Users only have access to what they need
• Custom Roles: Define custom permission sets for your organization
• Audit Logging: Track all access and changes to your account
• Team Isolation: Data is isolated between organizations

Employee Access

• Limited Access: Only authorized personnel can access customer data
• Purpose Limitation: Access only granted for support, maintenance, or security purposes
• Audit Logging: All employee access is logged and monitored
• Background Checks: All employees undergo background checks

Monitoring and Incident Response

24/7 Monitoring

• Real-Time Alerting: Automated alerts for security and performance issues
• Multi-Region Health Checks: Continuous monitoring from multiple global locations
• Error Rate Monitoring: Automatic detection of anomalies
• On-Call Engineers: 24/7 on-call rotation for critical issues

Incident Response

• Documented Procedures: Formal incident response plan
• Rapid Response: Security incidents addressed within minutes
• Post-Incident Reviews: Detailed analysis and preventive measures
• Customer Communication: Transparent communication about incidents

Vulnerability Management

• Regular Penetration Testing: Third-party security assessments
• Vulnerability Scanning: Automated scanning for security issues
• Patch Management: Rapid deployment of security patches
• Bug Bounty Program: Rewards for responsible disclosure

Operational Security

Secure Development

• Code Reviews: All code changes reviewed by multiple engineers
• Static Analysis: Automated security scanning in CI/CD pipeline
• Dependency Scanning: Regular updates and vulnerability checks
• Security Training: Regular security training for all engineers

Data Backup and Recovery

• Automated Backups: Daily encrypted backups of all data
• 30-Day Retention: Rolling 30-day backup retention
• Point-in-Time Recovery: Ability to restore to any point in time
• Disaster Recovery Plan: Documented procedures for data recovery

Business Continuity

• High Availability Architecture: No single points of failure
• Automatic Failover: Database automatically fails over to standby
• Edge-Based Routing: Redirects work even if origin is down
• Queue-Based Analytics: Analytics never block link redirects

Privacy and Data Handling

Data Minimization

• Collect Only What's Needed: We only collect data necessary to provide the service
• IP Address Truncation: IP addresses are truncated at ingestion (IPv4 to /24, IPv6 to /48) so individual addresses are never retained
• Anonymization: Analytics data anonymized where possible
• Retention Limits: Data automatically deleted per retention policies

Data Ownership

• You Own Your Data: All links, analytics, and configurations belong to you
• Data Portability: Export your data at any time in standard formats
• Deletion Rights: Request deletion of your data at any time
• No Data Selling: We never sell your data to third parties

Third-Party Security

• Vendor Review: All vendors undergo security assessment
• Data Processing Agreements: Contracts require compliance with our standards
• Limited Data Sharing: Only share what's necessary for service delivery
• Sub-Processor Transparency: Full list of sub-processors available

Uptime and Reliability

Service Level Agreement

Formal SLA terms for Business and Enterprise customers are being established in parallel with the SOC 2 audit. Specific commitments will be published as part of those contracts rather than promised in marketing copy.

• Infrastructure: Built on Cloudflare Workers and a managed database with automatic failover
• Monitoring: Continuous uptime monitoring across multiple global locations
• Transparency: Public status page (planned at status.routo.io)

Performance

• Edge processing: Redirect decisions happen at the edge, not after a round trip to a single region
• Async analytics: Queue-backed event processing means analytics never block redirects
• Cached resolution: Frequently-accessed links resolve from edge cache
• Concrete numbers: Documented in our public status page once published

Reporting Security Issues

Responsible Disclosure

If you discover a security vulnerability, we ask that you disclose it responsibly:

• Email: support@routo.io
• Response Time: We respond to all security reports within 24 hours
• Coordinated Disclosure: We work with researchers to verify and patch issues before public disclosure
• Recognition: Security researchers credited in our security acknowledgments

What to Include

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact and severity
• Any proof-of-concept code or screenshots

What Not to Do

• Access or modify customer data
• Perform actions that could harm availability
• Publicly disclose the vulnerability before we've had time to fix it
• Demand compensation for disclosure

Security Documentation

For Customers

Additional security resources available:

• Security Whitepaper: Detailed technical security documentation (available on request)
• Penetration Test Reports: Third-party security assessment summaries (available on request for Enterprise)
• Compliance Documentation: Certifications and audit reports (available on request)
• Data Processing Agreement: GDPR-compliant DPA available for all customers

For Developers

• API Security Best Practices: Guidelines for secure API integration
• Webhook Verification: How to verify webhook signatures
• Rate Limiting: API rate limit documentation
• OAuth Scopes: Fine-grained permission documentation

Contact Security Team

For security-related inquiries:

Security, Privacy & Compliance: support@routo.io

---

Last Updated: November 3, 2025

For more detailed information about our security practices, please contact support@routo.io or view our complete Privacy Policy and Terms of Service.