- At creation: the destination URL is checked against Google Web Risk and threat feeds, and our own rules score the domain age, redirect chain, brand look-alikes and the workspace's history. Most links are cleared in under a second.
- Follow-up fetch: within minutes we fetch the destination page to confirm it exists and does not contain known malicious patterns. This fetch appears to the destination as a URLCrop bot and never counts as a click.
- Re-scans: active destinations are re-checked on a schedule (more often for high-traffic links) and whenever we receive a report, because websites get hacked after links are created.
- Outcomes: Clear (redirects normally), Warning (interstitial), Held for review (not redirecting until a person checks), Blocked (disabled, owner notified).
We scan URLs, not people: no visitor data is sent to the safety providers.