Security at Peekd
Last updated: August 12, 2026
Peekd handles links people send to their clients. That means two responsibilities: keeping your account and data safe, and making sure a Peekd link never becomes a way to hurt the person who clicks it. Here's how both work.
Data protection
- All traffic is encrypted in transit using TLS 1.2 or higher, with HSTS preload enabled.
- Data is encrypted at rest.
- We never see or store payment card details. Payments are handled entirely by Paddle, who act as Merchant of Record.
Access control
- Row-level security is enforced at the database layer, not in application code, on every table that the application's API roles can reach. Those roles — the ones any browser or API request runs as — cannot bypass row-level security and cannot grant themselves additional privileges.
- Privileged operations run through narrow server-side functions with per-request identity verification.
- No browser client can write to billing or subscription state under any circumstances.
- Passwords are checked against known-breach databases at signup.
Link safety
- Every destination URL is screened against Google Safe Browsing before a link is created, then re-screened on a continuous schedule afterwards.
- Executable and script destinations are rejected outright.
- Redirect chains are fully resolved and validated — we check where a link actually ends up, not just the address that was submitted.
- Automated abuse detection, a public reporting channel, and same-day takedown capability.
Infrastructure
- Edge-hosted with DDoS protection.
- Full Content Security Policy, clickjacking protection, MIME-sniffing protection and browser permissions policy on every response.
- Automated dependency vulnerability scanning on every deployment.
Monitoring and review
- Continuous automated monitoring with alerting on anomalous activity.
- Ongoing automated security review of the application and database layers.
What we store
- The destination URL you provide.
- The time, IP address and user agent of each open.
- We do not sell data. We do not run advertising. We do not share your data with third parties beyond the subprocessors listed below.
- IP addresses attached to abuse reports are retained for 90 days.
Subprocessors
- Supabase
- database and authentication
- Cloudflare
- hosting and DDoS protection
- Paddle
- payments, Merchant of Record
- Resend
- transactional email
- Google Safe Browsing
- destination URL screening
- hCaptcha
- bot and abuse protection on public forms
- Lovable
- application platform and error telemetry
Reporting a problem
- Security concerns: security@peekd.link
- Link abuse: abuse@sharinglink.app
This page describes controls currently in place. It is not a certification and does not constitute a warranty.