🛡️ Trust center
Codes people can trust.
A QR code is a promise: scan me, I'll take you somewhere safe. Here's everything standing between a scammer and the people who scan your codes.
Or just add a + to the end of any link: shcd.us/menu+
Five layers, always on.
-
✉️
01
Every link has an owner
No anonymous redirects. A link only goes live after its creator confirms a real inbox, whether they have an account or not.
-
🔍
02
Every destination is scanned
Before a link goes live, its destination is checked against Google Web Risk threat lists and our own rules: no raw IPs, no hidden credentials, no redirect chains through other shorteners.
-
🔁
03
And scanned again, and again
A page that was clean on Monday can be hijacked by Friday. Live links are re-checked around the clock and switched off automatically if they turn bad.
-
🚩
04
Anyone can blow the whistle
Every link page has a report button, no account needed. When several different people flag the same link, it's suspended immediately while a person looks.
-
🧑⚖️
05
A human makes the call
Reports land in a review queue. Blocked links show a clear warning instead of redirecting, and owners can appeal.
0
data sold
We don't sell personal information or use it for cross-site ads. Link owners see aggregate stats, never scanners' IPs.
30
days, then IPs are cut
Scan IP addresses are truncated after 30 days. Approximate region, device and time are all a chart needs.
99.9%
redirect uptime
Committed on Business and Agency plans, with service credits if we miss.
Security basics, done properly
- ✓HTTPS on every link, including branded domains (certificates issued automatically)
- ✓Account and link passwords stored only as one-way hashes
- ✓Card payments handled entirely by Stripe
- ✓Strict security headers and rate limits on every public endpoint
- ✓Production data access limited to the people who run the service
Report something
Seen an SHCD.US code on a fake parking sign, in a phishing text, or stuck over someone else's code? Tell us. It takes thirty seconds and no account.