The safest URL shortener is one you can trust.
Safe links protect the people who click them. Here is how URLCrop checks destinations, separates customers, protects data and keeps visitor privacy for customers worldwide, and where to report a problem.
Are short links safe?
A short link hides its destination, which is why attackers like them. A responsible shortener has to check where links lead, act on abuse quickly and never make it easy to launder a bad URL. That is the standard we build to.
What you get
01
Destinations are scanned
Links are checked when created and re-scanned over time. Risky destinations are shown behind a warning page or blocked. Destinations that are new or unknown are not treated as safe for untrusted workspaces.
02
Strong sign-in
Passwords are hashed with argon2id and checked against known breaches. Two-factor authentication is available, and mandatory for staff and for owners and admins on Business and above.
03
Workspace isolation
Every customer workspace is separated at the database level with row-level security, and access is denied unless a role explicitly allows it. Another workspace’s data returns not found.
04
Encryption
Traffic uses TLS. Sensitive fields such as integration tokens, partner bank details and phone numbers are encrypted individually, and backups are encrypted before they leave the server.
05
Hosted in India, accelerated by Cloudflare worldwide
Application data, analytics and files are on a server in India. Cloudflare sits in front of our own hostnames for DNS and DDoS protection and caches only public static assets.
06
No raw IPs stored
Analytics keep hashed visitor identifiers and coarse location, not IP addresses. Web server logs keep IPs for 72 hours for security work, then delete them.
What happens when someone reports a link
STEP 01
Report it
Email business@urlcrop.com with the subject “Abuse” and the link.
STEP 02
We review it
Confirmed phishing, malware or spam links are disabled. The owner is told and can appeal.
STEP 03
Repeat abuse has consequences
Workspaces with confirmed abuse lose trust and can be suspended.
What is in place, and what is not claimed
Questions
Is URLCrop the safest URL shortener?
We do not rank ourselves against others. We build for safety by default: destinations are validated and scanned when a link is created and re-scanned on a schedule, and the result decides whether visitors are redirected, shown a warning page or blocked.
How do you protect personal data under GDPR and DPDP?
Our privacy design follows the EU and UK GDPR and India’s DPDP Act 2023. We store hashed visitor identifiers, not raw IPs. The Privacy Policy lists your rights and how to exercise them.
Do you store visitors’ IP addresses?
No. Analytics keep hashed identifiers and coarse location only. Web server logs hold IP addresses for 72 hours for security, and are then deleted.
Where is my data stored?
Hosted in India, accelerated by Cloudflare worldwide. Backups leave the server only as encrypted data. The Sub-processors page lists the vendors we use.
Are you SOC 2 or ISO 27001 certified?
No. We do not hold either certification today, and we do not claim them. Our security design targets OWASP ASVS Level 2.
How do I report a vulnerability?
Email business@urlcrop.com with the subject “Security”. We acknowledge reports within 2 business days, and good-faith research within our policy will not be met with legal action.
How do I report a phishing or malicious link?
Email business@urlcrop.com with the subject “Abuse”. Include the short link and what you saw.
Is two-factor authentication required?
It is required for our staff, and for owners and admins on Business and above after a 14-day grace period. It is optional on other plans and we encourage it.
Questions about security?
Write to business@urlcrop.com with the subject “Security”, or see how to reach the right team on the contact page.