Every upload is checked for malware
Photos, logos, videos, gallery images and documents are scanned by a malware scanning service before they can be used. Until a file is cleared, no card or page can show it. A file judged harmful is deleted from storage straight away, and the attempt is logged for our team.
Photos you scan to add a contact are handled apart: on Free they're read on your device and never uploaded, and on the paid plans they're deleted as soon as they've been read. How scanning works.
Short links are checked before and after
Every destination of a short link is looked up in Google's Web Risk list of malware and phishing sites when the link is made and whenever it's pointed somewhere new, and working links are checked again every day. A link to a site that's been listed since is turned off, and shows a page saying so. The free tools on this site check the links you enter the same way.
Links can only point to public web pages: not to private networks, not with a username or password in them, not to other link shorteners, and not to app installers or archives. The ending of a deleted link is never given to anyone else, so a printed QR code can't start pointing somewhere its owner didn't choose. Our team can turn off a reported link at once, and every such action is logged.
Webhooks, API keys and AI assistants
- Signed webhooks. Every contact sent to Zapier, Make or your server carries an HMAC-SHA256 signature made with that webhook's own secret and a timestamp, so your server can check it came from Linq and turn away old requests.
- Public addresses only. Webhooks only go to
httpsaddresses on the public internet. A name that points into a private network is refused when the delivery connects, and redirects aren't followed. - Hashed API keys. Only a fingerprint (a hash) of each key is stored, so a key is shown once, when it's made. Each key shows when it was last used, reaches only its owner's contacts, makes at most 120 requests a minute, and stops the moment it's revoked.
- AI assistants that can't do damage. Over MCP, an assistant can read and update your contacts, but can't delete them, send anything or see anyone else's. Because contact fields can hold what strangers typed on your form, the assistant is told to treat them as data, never as instructions.
- Encrypted connections to your apps. The sign-ins Linq keeps to send contacts to your CRM or Slack are encrypted with a key kept apart from the database, so a copy of the database alone doesn't give anyone access to your CRM.
More in integrations and AI.
Payments handled by Polar
Subscriptions are paid by card, Apple Pay or Google Pay through Polar, our payment partner and the merchant of record. Your card and bank details go to Polar, never to Linq: we only see your plan, seats and billing dates.
Counting views without tracking visitors
Insights count your card's views, saves and link taps, and where they came from, without recording visitors' IP addresses or device details with them. Short link clicks keep the country, the referring site and the kind of device, not the IP address. Our error reports are set not to store IP addresses either. Visitors only send you their details if they choose to.
Everything we collect, why, and for how long: Privacy Policy.
Accounts, teams and kiosks
- Sign-in is handled by Clerk, a dedicated sign-in provider, and the whole site and app run over HTTPS.
- On a team, owners, admins and members each see what their role allows, and contacts collected by team cards stay with the team when someone leaves.
- A team's own domain only serves that team's cards, so nobody can put someone else's card under their brand.
- A booth kiosk needs no account on the tablet, never shows who signed up before, and stops working the moment you turn it off.
Found a problem?
If you think you've found a security issue in Linq, email hello@linq-business.com with "Security report" in the subject, what you found and how to reproduce it. Please give us a chance to fix it before telling anyone else. For anything else, get in touch.