Trust is the product
Referrals contain personal information shared in confidence. Here’s how we protect it at every layer.
Tenant isolation
Every request resolves your workspace from a verified membership or API credential. A workspace ID supplied by a client is only ever a selector that the server re-checks.
Hardened sessions
Browser sessions use short-lived tokens in HTTP-only, SameSite cookies that scripts can’t read. Refresh tokens rotate and are scoped to the authentication endpoints.
Defence in depth on the web
Strict Content Security Policy, frame blocking, HSTS, CSRF origin checks and a hardened API gateway that never exposes internal hosts or error details.
Credential hygiene
API keys are generated with high entropy, hashed with scrypt and shown once. Keys carry explicit scopes, optional expiry and IP allowlists.
Encryption
TLS for data in transit. Credentials needed for outbound integrations are encrypted at the application layer and never returned by the API.
Immutable audit trail
Core changes write domain state, an append-only audit event and an outbox event in a single transaction, each with a correlation ID.
Consent evidence
Referrals store whether consent was obtained, how, when and under which privacy-notice version.
Abuse protection
Public forms use bot verification, throttling, strict input limits and responses that never reveal whether a contact already exists.
Safe integrations
Outbound webhooks are HMAC-signed, retried with backoff, never follow redirects and refuse private or internal network destinations.
Quarantined files
Uploads are limited by type and size, stored in quarantine and only downloadable after a clean security scan.
Responsible disclosure
Found a vulnerability? Email security@getmereferrals.com. Please don’t include personal data or credentials in your report, and give us reasonable time to fix the issue before disclosure.
Turn your partner network into a measurable growth channel.
See how teams capture, route and attribute every referral in one place.