Two things matter here: your data can never leak into another customer's workspace, and our domains can never become a phishing pipe. Both are enforced by the system, not by policy.
Every row carries a workspace id and row-level security enforces the boundary in Postgres itself.
An automated test attempts a cross-workspace read on every deploy. If it succeeds, the deploy fails.
Redirects run at the edge and never wait on an analytics write. Sub-100ms p95, 99.9%+ uptime target.
Link shorteners attract abuse. If we let ours get farmed, every customer's links inherit the bad reputation — so the guards are aggressive by design.
Every destination checked against reputation and safe-browsing data at creation.
The main phishing vector stays behind a paid, verified account.
Free accounts have enforced limits so abuse cannot hide in volume.
Email verification always; captcha and creation limits on new accounts.
New accounts start tight and loosen with age and verified payment.
Reported links are disabled immediately, everywhere at once.