Security & trust
A short link hides where it goes, so a shortener has to be careful by design. Here is what the product does to keep accounts, links and the people who click them safe — and, just as importantly, what we don't claim. The full security and trust pages live at b1.lc/security.html and b1.lc/trust.html.
How every destination is checked
Your account
Signing up needs a verified email address and passes a Cloudflare bot check; passwords are at least 10 characters and stored only as a bcrypt hash, never in plain text.
You can turn on a second sign-in step — a code from an authenticator app (with one-time recovery codes) or an emailed code — so a stolen password alone is not enough to get in.
You can see every signed-in device and sign out all other sessions at once, review the apps connected to your account, and limit API keys by permission, by IP range and by country. Enterprise teams can sign in through their own identity provider with SAML or OpenID Connect, and provision users with SCIM.
Every destination is checked
When a link is created or its destination changes, that destination is scanned against threat sources including PhishTank, URLhaus, SURBL, urlscan.io and AlienVault OTX (and Google Web Risk when it is enabled). The same check runs on fallback URLs, A/B variants, smart-rule targets and monitoring backups — not just the main link.
Clearly dangerous destinations are refused outright. A newly flagged link on an established account is shown a warning first and its owner is emailed, rather than cut off without notice, and active links are re-scanned daily. If a link is blocked by mistake, the owner can ask a person to review it.
Short links that resist guessing
Because short codes are short, the service watches for anyone trying to walk through them: too many unknown links from one visitor in a short window gets a temporary block, and it behaves the same whether a code exists or not, so it gives nothing away.
For links that should stay private — invoices, documents, personal offers — you can create a 9-character link that is not meant to be guessable, instead of a short public code.
Reporting a bad link
Anyone can report a link they believe is being misused, with or without an account — see the report a link page and the acceptable-use policy for what is not allowed. You can also report directly at b1.lc/abuse.html.
Every report triggers an immediate scan; links confirmed dangerous are disabled straight away, and the rest are reviewed by a person, usually within one business day.
The people who click your links
Click analytics count real people — known bots and link-preview scanners are separated out. Location is worked out on the service's own servers from local databases, so visitor IP addresses are not sent to an outside lookup service, and those IP addresses are shortened after 90 days.
This data is used to give the link's owner their analytics. It is not sold and is not used to build advertising profiles. Links sent over messaging never store phone numbers or email addresses, and a link's public stats page never shows personal data. What is recorded, and for how long, is set out in the privacy policy.
Your data stays yours
You can export your account data and move your links out — a full export to JSON or CSV — at any time, and delete your account when you want to.
Plan limits only restrict creating new items, never serving existing ones: after a downgrade or cancellation, the links, QR codes and pages you already made keep working, and no ads are added.
Keeping links online
Redirects run as their own service, separate from the dashboard and the API. If the database is ever unavailable, short links keep working from a last-known-good cached copy and clicks are queued and recorded afterwards, rather than lost.
In a load test on 22 October 2026, the redirect service handled about 300 redirects per second on a single server while recording every click. The site, redirects, API and certificates are monitored every minute, with a public status page at b1.lc/status.html; an automated test suite runs before every release and each night; and SSL certificates are issued and renewed automatically.
Who we work with
The service relies on a small set of named sub-processors: Cloudflare (network, DNS and the bot check), Stripe (payments), BroadNet Technologies (email and SMS), Google Fonts, and the threat-intelligence services above — which receive only the destination URL being checked.
For a data-processing agreement or a security questionnaire, write to support@broadnet.me; for privacy requests, privacy@broadnet.me.
This website
shortlen.com is served over HTTPS through Cloudflare, with HSTS, a Content-Security-Policy and a set of security headers. Forms use a spam honeypot and a Cloudflare Turnstile check, and the site sets no tracking cookies of its own.
Our security contact details are published at /.well-known/security.txt.
What we don't claim
We only state protections that are actually in place. Shortlen does not claim security certifications (such as SOC 2 or ISO 27001), a specific hosting region or country, off-site or geo-redundant backups, or an uptime percentage or SLA. If you need something for a vendor review, contact us or write to support@broadnet.me.