What sovereignty means here
"Data sovereignty" is used loosely in vendor decks. On this page it means three things that can be checked, not a flag on a map. You own your links and your click data. The operator is an Ethiopian business that answers to Ethiopian law and to the Ethiopian Communications Authority. And your data is yours to export or delete, in a form you can hand to an auditor.
It does not mean the servers sit inside Ethiopia. They do not: Ethiopia has no Google Cloud region, so the application and the database run in a cloud region outside Ethiopia, and we state that plainly instead of claiming in-country hosting. What we do about it is the substance of this page — the controls, the paper trail and the local accountability that a security review is actually testing.
- Your data stays yours. Links, destinations, click history and branding belong to the account that created them, and leave the platform on request.
- The operator is local and named. EthioLink is Ethiopian-owned and Ethiopian-operated; the privacy contact is [email protected] and the legal contact is [email protected]. Disputes are heard in the courts of Addis Ababa under Ethiopian law.
- The obligations are named too. We work to the Ethiopian Personal Data Protection Proclamation (PDPP) 1321/2024, with the Ethiopian Communications Authority as supervisory authority, including its 72-hour breach-notification duty.
Straight answer for a security questionnaire: hosting region — outside Ethiopia (Google Cloud); operator jurisdiction — Ethiopia; click data — hashed at collection with no raw IPs stored anywhere; export and deletion — available on request; SLA — Enterprise plans only, published on the status page.
Where your data lives
Every category of data we hold, where it is kept, how it is protected and how long it stays. This is the same inventory documented in the Privacy Policy, restated here in the form a reviewer reads it.
| Data | Where it lives | How it is protected | Retention |
|---|---|---|---|
| Account (email, username, optional full name, consent timestamp) | Application database on Google Cloud, region outside Ethiopia | Per-account minimum-privilege queries; consent recorded at registration | Life of the account |
| Password | Never stored as written | scrypt hash with a unique per-account salt, compared in constant time | Until you change or delete the account |
| Session tokens | Database, as SHA-256 hashes only | The raw token exists only in your cookie; sessions expire and are destroyed on logout | Until expiry or logout |
| API keys | Database, as SHA-256 hashes plus a short visible prefix | Revocable at any moment; a revoked key fails immediately | Until you revoke or delete the key |
| Click events | Analytics tables on the same database | A salted one-way hash of the visitor IP (the raw IP is never written to disk), the referring hostname, a device/browser guess from the User-Agent, a country derived offline, and a random visitor cookie | Retained for reporting; no raw IPs to leak |
| Audit log | Append-only table | Actions such as plan changes and administrator decisions, with the source address stored as the same salted hash | May be retained where law requires it |
| Branding assets (workspace logo) | Files on the application host | Type-checked (SVG is sanitised, PNG is verified by header), size-capped at 200 KB and 512×512 | Until replaced or removed by the workspace owner |
Four processors appear in that path, all listed in the Privacy Policy with what they see: Google Cloud (hosting the application and the database), Cloudflare (DNS, CDN and edge protection), Brevo (transactional email such as verification and digests) and Chapa (payments in birr). No advertising network, no data broker, and no third-party analytics script on any page of this site.
Two cookies exist on the whole product: ethiolink_session for your login, and el_v, a random identifier that lets a tap on a short link and the redirect that follows count as one visit. Neither is used for advertising, and the visitor cookie carries no personal data.
What an Ethiopian security review asks
These are the controls a reviewer can verify from outside, without a call. They exist because a link shortener is a redirector sitting in front of your brand: if an attacker can edit a destination, they can impersonate you.
- Accounts are verified and sessions are hashed. Email verification before a login can be used for anything, scrypt password hashing with a unique salt and a constant-time comparison, and session tokens stored only as SHA-256 hashes — the raw token exists only in the browser cookie.
- Transport and browser hardening. TLS/HTTPS with HSTS in production, AES-256 encryption at rest on the hosting platform, a strict Content-Security-Policy,
X-Frame-Options: DENY,X-Content-Type-Options: nosniff, a no-referrer policy, cross-origin isolation headers, and a 32 KB request-body cap on JSON endpoints. - CSRF and write throttling. A cross-origin write is rejected unless it comes from this site, and write endpoints are rate limited per client address — including separate limits on registrations and repeated failed logins.
- Open-redirect and injection defence. A destination must be a valid
httporhttpsURL before a link is created, administrator actions are written to an append-only audit log, and an error response never carries a stack trace or an internal path. - Tenant isolation. A link that belongs to a workspace with a branded host resolves only on that host — see the next-but-one section.
- Signed webhooks. Enterprise click events are delivered with an HMAC-SHA256 signature over the raw body, so a receiver can prove the delivery came from us. The developer hub has the verification code.
- Upload validation. A workspace logo must be a sanitised SVG or a PNG verified by signature and
IHDR, capped at 200 KB and 512×512. - Audits on every release. An automated penetration and regression suite runs against each build, alongside the functional suite.
Export, deletion and PDPP duties
Under the PDPP you can see your data, correct it, take a copy, and ask for it to be deleted. Here is how each of those actually happens on this platform.
| Right | How to exercise it | What you receive |
|---|---|---|
| Access | Your dashboard shows every link, destination and click count; the analytics pages show referrers, countries and devices. | The data itself, on screen, behind your own login. |
| Portability / export | CSV export of your links is available on Starter and above. For a complete export of account data, links and click history, write to [email protected]. | A machine-readable copy you can load into your own systems or hand to an auditor. |
| Correction | Edit the link destination, title or workspace branding at any time; correct account details from the dashboard. | The corrected record, with the change reflected immediately in redirects. |
| Deletion | Request deletion of your personal data (or a whole workspace) at [email protected]. | Deletion, except where we are legally required to keep a record — audit entries are pseudonymised already, and click analytics cannot be tied back to a person because the IP is hashed. |
| Objection and complaint | Tell us what you object to, or complain to the Ethiopian Communications Authority (ECA), the supervisory authority named in our Privacy Policy. | A written response; unresolved complaints can go to the ECA. |
Two duties of our own sit on the other side of that table. If a personal-data breach occurs that is likely to result in risk to data subjects, we notify the ECA and the affected account holders within 72 hours of becoming aware of it. And because click analytics are hashed at collection, an export intended for an auditor contains no raw IP addresses to redact — they were never there.
Tenant isolation by design
Most link shorteners put every customer in one namespace: sho.rt/anything. That is convenient and it is also a liability, because a code that is guessed or leaked from one customer's campaign resolves on the same domain as yours. EthioLink gives an institution its own host instead.
- A workspace can hold a branded host —
yourbrand.short.et— on the Business plan (one host) and Enterprise (up to five). Verified formats only: 3–32 lowercase letters, numbers and hyphens, starting and ending with a letter or a number. - Names that could be confused with the platform are refused (
api,www,admin,dashboard,blog,mail,statusand the rest of the reserved list), and a host can never shadow an existing short code or an existing username. - A link created inside the workspace belongs to the workspace, and it resolves on the branded host.
short.et/<code>for that same link returns a 404 on purpose — the tenant boundary is the host, so a leaked root URL cannot expose another tenant's destination, and a branded campaign link can never be collected by someone else's root-domain campaign. - Codes stay globally unique. A branded link cannot re-use a code that already exists on the root domain, which is what keeps analytics and QR codes unambiguous.
- Changes are slowed down and recorded. A branded host is locked for 30 days after each change to prevent hijack-by-rename, and every create, change, enable or disable of a host is written to the administrator audit log.
If your review asks "can another customer's link appear under our domain, or ours under theirs?" the answer is no, and the reason is structural rather than a setting. The full rule set, including the redirect namespace table, is in the product tour and in the API documentation.
Local support, Ethiopic-first UX
A control you cannot ask a question about is not a control. Support runs from Ethiopia, in Amharic and English, from the same small team that operates the service — the addresses published on our legal pages ([email protected] for commercial and contractual questions, [email protected] for data protection) reach humans who can read the database, not a ticket queue in another time zone.
Billing is local too: plans are priced in birr — Free at 0, Starter at 199, Business at 499 and Enterprise at 1,499 ETB per month — and card and wallet payments are collected through Chapa, an Ethiopian payment provider, so a procurement department is not asked to justify a foreign subscription.
Ethiopic-first is not a translation layer bolted on afterwards:
- Short codes in Ge'ez. Pick
short.et/ዜናinstead of a random string, and EthioLink generates a Latin twin (short.et/zena) automatically so the same link survives SMS gateways, printers and systems that only accept ASCII. Both forms are returned by the API and both resolve. - Amharic in the interface. Dashboard headings, section labels and empty states carry Amharic alongside English, rendered in Noto Sans Ethiopic so Ge'ez never falls back to a broken glyph set.
- Content in the languages your team writes in. The blog and this solutions hub cover Amharic, Tigrinya, Oromo and English, and the creator page is aimed at Ethiopian audiences first.
- Local data practices, described locally. Consent is captured at registration with a timestamp you can audit, and the Privacy Policy names the PDPP, the ECA and the 72-hour breach duty rather than quoting a foreign regulation that does not apply here.
Procurement checklist
Copy this table into your own review template. Every answer is a statement about the running product, not a roadmap item.
| Question | Answer |
|---|---|
| Where is our data hosted? | Google Cloud, in a region outside Ethiopia (there is no Ethiopian region). Stated in the Privacy Policy rather than claiming in-country hosting. |
| Who is the controller and who is the processor? | Your organisation is the controller of the audience data you collect through a link; EthioLink processes it to run the redirect, the analytics and the reporting you asked for. |
| Are raw visitor IP addresses stored? | No. They are hashed with a server-side salt at collection; the plaintext is never written to disk, in click analytics, login fingerprints or audit entries. |
| Can we export everything? | Yes — CSV export of links on Starter and above, and a full account, link and click-history export on request to [email protected]. |
| Can we have data deleted? | Yes, on request. Pseudonymised audit entries may be retained where the law requires it; click analytics cannot be traced to a person. |
| Will our links ever appear on another customer's domain? | No. Links created in a branded workspace resolve only on that host; the root-domain URL returns 404 by design. |
| What is the breach-notification process? | Notification to the ECA and affected account holders within 72 hours of becoming aware of a qualifying breach. |
| Is there a service-level commitment? | Uptime and response-time commitments are Enterprise-plan commitments, published on the status page. Free and Starter are provided as-is. |
| Do you run advertising or third-party analytics? | No. Two first-party cookies exist (session and a random visitor id) and no advertising network or data broker is involved. |
| Is support local and in Amharic? | Yes — an Ethiopian team, Amharic and English, reachable at the addresses on our legal pages. |
| Can we pay in birr? | Yes — ETB pricing from 0 to 1,499 per month, collected through Chapa. |
Questions we get asked
Do you host data inside Ethiopia?
No, and we do not pretend otherwise. Ethiopia has no Google Cloud region, so the application and database run in a region outside the country, with encryption at rest and TLS in transit. What is local is the operator, the accountability, the support and the user experience — and this page exists so that a reviewer does not have to take that on trust.
Can we run a pilot before committing to a plan?
Yes. The Free plan gives 50 links, Ge'ez or Latin codes, click analytics and no card requirement. Starter and Business add unlimited links, digests, advanced analytics and API access; Enterprise adds team workspaces, branded hosts, white-label QR codes, webhooks and SLA monitoring.
Can the short links use our own domain?
Yes. A workspace can claim a branded host — yourbrand.short.et — one on Business and up to five on Enterprise. Every link created inside the workspace, and every QR code for it, uses that host automatically, so printed material carries your brand instead of ours.
What happens to our links if we stop paying or leave?
Your links and their click history remain yours: export them first, then ask for deletion. We do not resell or reassign your codes to another customer, and a link's destination can be changed or retired by the owner at any time — which is exactly why keeping the code rather than printing a new one is the safer choice for campaigns already in the field.
Does Ge'ez really work in a link, or is it decoration?
It works. A Ge'ez code is a real path segment in the link and resolves like any other; EthioLink also issues a Latin twin so the same destination has a URL that survives SMS gateways and older systems. The language guide shows it end to end for Amharic, Tigrinya, Oromo, Somali and Afar.
Is there an SLA on the free tier?
No — the Terms of Service state that Free and Starter carry no uptime commitment, and that uptime and response-time commitments are Enterprise commitments stated separately. Current availability, sampled every minute, is public on the status page.
Next steps
Three ways to take this further, depending on who is asking. If it is an auditor, send them this page, the Privacy Policy and the Terms of Service. If it is your developer team, the developer hub covers the API, the bulk engine and signed webhooks. If it is procurement, start on the Free plan, prove the workflow internally, then move the workspace to Business or Enterprise for branded hosting and SLA.