Security Practices

Last updated: September 2026

A concise, factual summary of how DMflux protects data. For disclosure details see the Privacy Policy; this page describes the controls we actually run.

Infrastructure

  • •All traffic is served over TLS. Tracking redirects, the dashboard, and public reports are HTTPS-only.
  • •The application runs on Vercel; the click redirect runs as an isolated Cloudflare Worker; the database is a dedicated Supabase Postgres instance in the EU (Ireland).
  • •The click worker holds no customer PII beyond what a single redirect request naturally contains.

Access control

  • •Row-Level Security (RLS) is enabled on the database tables that hold customer data; anonymous visitors have zero read access to campaign data (enforced and tested with SQL assertions on every migration).
  • •Privileged database operations use a service-role key that exists only on servers — never in the browser, never in git.
  • •Staff accounts are separate from customer accounts, have no organization membership, and every admin read of customer data is written to an append-only staff audit log.
  • •Staff cannot update or delete audit records (enforced and tested with rollback-safe SQL assertions).

Click data minimization

  • •Raw IP addresses are never stored — click records contain one-way hashes only, and the hash is pseudonymous (it cannot be reversed to an IP address or identity). The hash is stable across a customer’s campaigns, which is how unique and returning visitors are counted.
  • •Duplicate-click detection records expire from the edge store within minutes.
  • •No cookies and no JavaScript are used on the tracking redirect path.

Payments

  • •Card details are collected and processed entirely by Paystack; DMflux never sees or stores card numbers.
  • •Incoming payment webhooks are verified with HMAC-SHA512 signatures using constant-time comparison, and event processing is idempotent (each webhook event can be applied at most once).

Application hardening

  • •Auth endpoints are rate-limited; the dashboard authentication session is scoped to the hub domain and managed server-side by Supabase.
  • •All user-supplied content rendered into emails and redirect pages is HTML-escaped; redirect destinations are validated to be http(s) URLs.
  • •Dependencies are audited; lint, type-checking, and build checks run on every code change, and automated SQL security assertions run on every database migration.

Incidents and deletion

  • •If a security incident affects your personal data, we will notify affected users and the NDPC as required by the Nigeria Data Protection Act 2023.
  • •On account deletion request we remove account data within 90 days; campaign click history can be deleted on request as described in the Privacy Policy.