Signing in
Sign-in is handled by Clerk, a dedicated sign-in provider, so CTAurl never stores your password. Every page of the app and every change is checked against your session and your workspace before it runs.
Encryption
CTAurl's short links are https:// addresses, and the app and this site use HTTPS, so data travels encrypted between your browser, Cloudflare and the providers CTAurl uses.
Workspaces and seats
On CTAurl, links belong to a workspace rather than to one person. Whether you can invite other people to share a workspace depends on your plan. People you invite can act on the workspace's links, so invite only people you trust.
Destination checks
When you save a destination, CTAurl checks that it is a valid web address and refuses addresses that point at private or internal networks. CTAurl does not check destinations against third-party lists of unsafe sites. Public reports through Report abuse are how harmful links are found today.
Short links are a known route for phishing. The Council of Anti-Phishing Japan reports that attackers send victims to phishing sites through short-URL services and other redirect services (monthly report for June 2026, published July 2026). An action domain gives everyone one check they can make by eye: a buy-it.now link should lead to something you can buy, and a buy-it.now link that leads anywhere else breaks the Acceptable Use Policy.
Disabling harmful links
A CTAurl link used for phishing or malware is disabled. A disabled link answers 404 and no longer reaches its destination. The Acceptable Use Policy says what is not allowed and how to appeal.
Payments
Payments are handled by Stripe. CTAurl never sees or stores a full card number.
What we do not offer yet
CTAurl does not offer single sign-on (SAML), SCIM, audit logs of destination changes, IP allow-lists, security certifications such as SOC 2 or ISO 27001, a data processing agreement, or an uptime commitment. If your organisation requires any of these, CTAurl is not the right fit yet.
Reporting a vulnerability
To report a vulnerability, email support@ctaurl.com with the subject line "Security". Describe what you found and how to reproduce it. Do not access other people's data, and do not test against links or accounts that are not yours.
Questions people ask
Does CTAurl store my password?
No. Sign-in is handled by Clerk, a dedicated sign-in provider, so CTAurl never receives or stores your password. The app checks your session and your workspace on every page and every change before anything runs.
Does CTAurl scan destinations for malware?
Not yet. CTAurl checks that a destination is a valid web address and refuses internal or private network addresses. It does not match destinations against lists of unsafe sites today. Harmful links are found through public reports to support@ctaurl.com, and a link used for phishing or malware is disabled when found.