Trust
Built to be trusted with money and with your users.
Security practices
How we protect your data.
Credentials encrypted at rest
Store and RevenueCat credentials and webhook secrets use AES-256-GCM envelope encryption. They are decrypted only inside the jobs that need them and never logged.
API keys hashed
Secret API keys are stored as SHA-256 hashes and shown once. Token checks use constant-time comparison.
Tenant isolation
Every query is scoped to the organization and app of the caller. Tests check that no service reads across organizations.
Verified webhooks
Incoming events are verified first (Apple’s signed payloads, Google’s Pub/Sub token, RevenueCat’s authorization header, Stripe signatures), stored, acknowledged, then processed idempotently.
Two-person payouts
Payout batches above a limit you set need a second approver. Sensitive actions are written to an audit log.
Least privilege
We ask for keys with the narrowest role that works, and document which role.
Privacy stance
What we never collect.
No fingerprinting
We never match a click to a device by IP address, user agent or device data. Apple’s rules forbid it, and it would make receipts guesses.
No IDFA, no ATT prompt
The SDK never asks for or reads the advertising identifier.
No clipboard reads without a tap
Codes are pasted only through Apple’s paste control, after the user taps it.
No raw IP addresses stored
A short-lived salted hash is used for rate limiting only, never for matching.
No tracking cookies
The click ID lives in the link’s URL path and the server session.
No silent changes
Locked commissions change only through new, linked adjustment entries, each with a reason.
Proofline acts as your data processor. Owners can delete an end user’s data through the API, and the deletion propagates. In the EU and UK, creator landing pages store nothing non-essential without consent.
App Review
Guidance for your submission.
The SDK ships a privacy manifest that declares no tracking. It reads no device properties for identification and uses Apple’s paste control rather than reading the clipboard. Apps in the Kids category aren’t supported in v1, because Apple restricts third-party analytics there.
The App Review and privacy label guide lists what the SDK collects and how to answer each question in App Store Connect.
Subprocessors
Who processes data for us.
| Company | Purpose |
|---|---|
| Vercel | Hosting for the website, dashboard and APIs |
| Neon | Managed Postgres database |
| Stripe | Owner billing and, when enabled, creator payouts (test mode for now) |
| Resend | Transactional email, when enabled |
DPA and status
Agreements, status and disclosure.
Data processing agreement
Available on request for beta customers. It is being finalised with our lawyers. Email privacy@proofline.link.
Status
A public status page launches with general availability. Beta customers get incident notices by email.
Responsible disclosure
Found a vulnerability? Email security@proofline.link. We reply within two working days, keep you updated, and won’t take action against good-faith research.