Security, plainly stated
What we do today, what we're working on, and how to report a vulnerability.
What we do today
Data in transit
- TLS 1.2 and 1.3 only (1.3 preferred), with HSTS enforced for a year including subdomains
- Perfect forward secrecy via X25519
- Let's Encrypt certificates, renewed automatically
Data at rest
- Postgres 18 on a dedicated server in the EU (Helsinki); it accepts connections only from the server itself
- Full database backup every night, kept 1 day on the server and 7 days off-site
- API keys stored hashed (SHA-256); the plaintext is shown once, on creation
- Cloud mode LinkedIn sessions (opt-in only) encrypted with AES-256-GCM; the key is held only in the API server environment, never in the database or backups, and no endpoint returns the cookie
Access control
- Human access via SSO and hardware MFA (YubiKey)
- The database is never exposed to the internet; the application connects locally
Operations
- Incident response playbook with a 60-minute customer notification target
- Nightly backups: at most 24 hours of data at risk; restoring takes about an hour
- Every deploy is checked before it receives traffic and rolled back automatically if unhealthy
Compliance track
| Framework | Status | When |
|---|---|---|
| GDPR | Aligned | Since launch |
| CCPA and CPRA | Aligned | Since launch |
| SOC 2 Type I | In progress | Audit Q3 2026 |
| SOC 2 Type II | Planned | Targeted for 2027 |
| ISO 27001 | Planned | After SOC 2 |
Responsible disclosure
We acknowledge every report within 12 hours. In-scope issues are paid by severity, and we credit you by name on a security acknowledgements page unless you opt out.
- Critical
- $5,000
- High
- $2,000
- Medium
- $500
In scope: *.linkfetch.io, the Chrome extension and the MCP server.
Out of scope: rate-limit bypass, missing headers on their own, and denial of service.
Report to info@linkfetch.io.