Security
A QR code sits in public. Anyone can photograph it, so the interesting question is not whether the image is secret — it is not — but what happens after the scan: where the data goes, who can read it, and whether you can shut a code down after it is printed.
Everything below describes what the product actually does today. We do not claim certifications we do not hold.
Traffic is encrypted end to end
Every request runs over TLS. HSTS is enabled site-wide, so browsers refuse to fall back to plain HTTP once they have seen the site.
Passwords are hashed with bcrypt
Account passwords are never stored in readable form. They are hashed with bcrypt at cost factor 12–14 before they reach the database.
Servers are in Germany
Hosting is provided by Hostinger International Ltd.; the servers are located in Germany. A data processing agreement under Art. 28 GDPR is in place.
No Google Analytics, no Meta Pixel
Product analytics run through a single provider on its EU endpoint, and only after you accept analytics cookies. Decline, and no analytics events are sent at all.
QR codes can be locked down
Dynamic codes support password protection, an expiry date and a maximum scan count. A code can also be deactivated at any time without reprinting.
Geolocation is resolved locally
Scan locations are derived from a local IP database on our own server. Scan data is not handed to a third-party geolocation service.
Reporting a vulnerability
If you find a security issue, email support@zeuz-it.com with steps to reproduce. Please give us a chance to fix it before disclosing it publicly.
Security questions
Where is QR code scan data stored?
On servers in Germany, operated by Hostinger International Ltd. as a processor under Art. 28 GDPR. Scan data does not leave the EU.
Can I password-protect a QR code?
Yes. A dynamic QR code can require a password before the destination opens. You can also set an expiry date, cap the number of scans, or deactivate the code entirely — all without reprinting it.
Do you use Google Analytics?
No. There is no Google Analytics and no Meta Pixel on the site. Product analytics run through a single provider on its EU endpoint, and only after you accept analytics cookies. If you decline, no analytics events are sent.
How are account passwords stored?
They are hashed with bcrypt at cost factor 12–14 before they reach the database. Passwords are never stored in a readable form and cannot be recovered — only reset.
What happens if I delete a QR code?
The short link stops resolving immediately, so scans of the printed code no longer reach the destination. Retention of the associated scan records follows the periods set out in the privacy policy.