Security
Secure for you. Private for the people scanning.
A QR platform sits between your printed brand and your audience. Cue treats both sides of that trust seriously — here's exactly how.
Encryption in transit
Everything — your dashboard, your data, and every scan — travels encrypted, with no unencrypted option (TLS 1.2+).
Privacy-preserving analytics
We count scanners without knowing who they are. Scan records hold an anonymised, rotating identifier (a salted hash) — never a raw IP address — location stops at city level, and device details are reduced to broad categories.
Signed webhooks
Every notification Cue sends to your systems is cryptographically signed (HMAC-SHA256), so your team can verify it genuinely came from us and hasn't been tampered with.
Role-based access control
Owner, admin, and member roles scope who can create, retarget, export, and administer — enforced on every request, not just hidden in the UI.
Audit logging
Destination changes, exports, key changes, and every automated update are recorded permanently — who, what, and when — visible in the dashboard on Business and above.
Access key safety
Access keys are shown once, stored so that nobody — including us — can read them back, and can be switched off instantly. Each key has its own limits, so a leaked key does limited damage.
GDPR-friendly by architecture, not by checkbox
Most scan-tracking products collect everything and rely on policy to stay compliant. Cue inverts that: the analytics pipeline physically cannot produce a person-level profile, because identifying data is hashed or discarded before it ever reaches storage.
- Scan analytics are engineered for data minimisation: no raw IPs, no cross-site identifiers, no per-person profiles.
- Data is processed in the EU/UK; a signed DPA is available on Enterprise plans.
- Retention follows your plan and your instructions — deleting a code or workspace deletes its scan events.
- Data-subject requests are simple because we hold no directly identifying scanner data in analytics.
Found something? Tell us first.
We welcome good-faith security research. Report vulnerabilities to support@scancue.co and we'll acknowledge your report, keep you updated, and credit you if you'd like.