Security

Hosting and network

Cardline runs on managed cloud infrastructure with private networking between the application and the database. Public card pages are served from a CDN edge; the admin and API sit behind rate limiting and automated abuse detection. Business-plan customers can pin data residency to the EU.

Encryption

All traffic is served over TLS 1.2 or higher with HSTS. Data at rest — including database volumes, uploads, and backups — is encrypted with AES-256. Secrets are held in a managed secret store, never in source control.

Access control

• Role-based permissions in-product: owner, admin, and member, with card editing scoped by role.
• SAML 2.0 single sign-on and SCIM provisioning on the Business plan.
• Internal access is least-privilege, granted per task, requires multi-factor authentication, and is reviewed quarterly.
• Production access is logged; engineers do not read customer card content as a matter of routine.

Audit logging

Card creation, edits, publishing, permission changes, exports, and admin invitations are recorded with actor, timestamp, and before-and-after values. Admins can export the log, which is usually what a security questionnaire is really asking about.

Deprovisioning

Removing a member from your identity provider deactivates the account and unpublishes the card, so the link stops resolving instead of quietly representing your company after they leave. Without SCIM, an admin can do the same in one click.

Backups and resilience

Encrypted automated backups run daily with point-in-time recovery, and restores are tested on a regular schedule. Backups inherit the retention and deletion commitments in the DPA.

Application security

• Dependency scanning and automated patching in continuous integration.
• Peer-reviewed changes; no direct pushes to production branches.
• Input validation and output escaping on every card field, since card pages are public by design.
• Third-party penetration testing, with a summary letter available to Business customers under NDA.

Privacy by design on this website

The marketing site uses cookie-less aggregate analytics and loads no advertising or session-replay scripts. The QR and vCard generators run entirely in your browser — the details you type are never transmitted to us.

Reporting a vulnerability

Email security@gocardline.com with steps to reproduce. We acknowledge within two business days, keep you updated, and will not pursue legal action against good-faith research that avoids privacy violations, data destruction, and service degradation. Please do not test against other customers' cards.