qrlia.

Trust and security

Last updated 15 October 2026

The short version: your data stays in the EU, it is backed up every night, only a small team can reach the servers, and your printed QR codes never stop working because of a billing change.

Where your data lives

  • Application, database and uploaded files run on servers we operate at Hetzner Online GmbH in Germany (EU).
  • Scan records store a country and city derived from the IP address, plus a daily-rotating hash; the IP address itself is never stored.
  • We don't sell data, run ads or share scan data with third parties.

Backups

  • Databases and uploaded files are copied every night to separate backup storage, outside the servers that run qrlia.
  • The encryption keys that protect our deployment secrets are backed up separately, encrypted.
  • Restores are practised, not theoretical: we restore from these backups when something needs recovering.

How it is protected

  • All traffic is encrypted with HTTPS. Only the web ports are reachable from the internet; administration happens over a private, encrypted network.
  • Passwords are stored as bcrypt hashes, API keys as one-way hashes; neither can be read back, not even by us.
  • Sign-in and password-reset attempts are rate-limited, and sign-up is protected against bots.
  • Team members get roles (admin, editor, viewer), and API keys can be limited to one company.
  • Dependencies are kept current and checked for known vulnerabilities before each release.

Your QR codes keep working

If you downgrade or cancel, every dynamic QR code you created keeps redirecting on the same link. See pricing and the terms.

Your data, your control

  • Workspace admins can export everything (QR codes, scans, settings) as a machine-readable file through the API at any time.
  • Scan history can be exported as CSV from the dashboard.
  • Ask us and we delete what we aren't required to keep by law.

Who processes data for us

The full list of processors, with what each one does, is in our privacy policy. A data processing agreement (DPA) is available on request.

Reporting a security issue

Found a vulnerability? Write to support@qrlia.com with "security" in the subject. We read every report, reply within two working days and won't take action against good-faith research.