Trust centre
What CTAurl promises, and how it works underneath
The CTAurl trust centre: the three promises on every plan, how a short link is answered, what a click record holds, and how security and abuse reports are handled.
Last reviewed 27 October 2026 by the CTAurl team
Three promises on every plan
These three promises are the same on Free, Starter, Growth and Scale. They exist because a printed code or short link depends on whoever answers it: when Google retired its free URL shortener, links with no recent activity stopped responding after 25 August 2025, while active links were kept (Google Developers Blog, July 2024, updated August 2025). Separately, as a fact about how the product works, every CTAurl QR code is dynamic: the printed pattern never changes, and where it points can.
Codes already printed keep scanning and open the page they last pointed to.
A link you published last year and never touched is still there.
A busy weekend does not change your invoice.
Exceptions to the first two: abuse of the service, a legal requirement, or CTAurl ceasing to operate, in which case we give advance notice and an export.
Go deeper
Each page below covers one subject in detail.
Redirects and reliability
What happens between the tap and the page: one lookup, a 302, and counting after the redirect has gone.
Learn more
What a click record holds
Every field we keep, the ones we never keep, and the per-link privacy setting.
Learn more
Security practices
Sign-in, destination checks, and what we do not offer yet.
Learn more
Report a harmful link
No account needed. A person reads every report.
Learn moreTerms and policies
Terms of Service, Privacy, Cookies and Acceptable Use in plain language.
Learn more
What happens when you stop paying
Five questions to ask any provider before a print run.
Learn moreFrequently asked questions
Does CTAurl have SOC 2, ISO 27001 or an uptime SLA?
No. CTAurl holds no security certifications, including SOC 2 and ISO 27001, and offers no uptime commitment, single sign-on or data processing agreement today. There is no public status page either. If your organisation requires any of these, CTAurl is not the right fit yet.
Where does CTAurl store my data?
CTAurl stores links and account data in Cloudflare's database service and click counts in Cloudflare's analytics store, in data centres outside Hong Kong. Sign-in is handled by Clerk and payments by Stripe, so CTAurl never stores your password or a full card number. The Privacy Policy lists every provider.
Who do I ask a security question at CTAurl?
Email support@ctaurl.com; a person reads every message. If you found a vulnerability, use the subject line "Security", describe what you found and how to reproduce it, and do not test against other people's links or accounts.