Security you don't have to worry about

Checked by outsiders, not just by us.

- PCI DSS compliant
  247 CyberLabs, an independent Qualified Security Assessor, rated our loyalty processing service Compliant with PCI DSS v4.0.1. A full assessment, not a self-assessment.
- Card data stays out
  Members enter card details in fields hosted by Stripe, Braintree, or Adyen. We only receive a token, so card numbers are never stored with us.
- Hosted in your region
  US customers' data is hosted in the US, EU customers' data in the EU. Encrypted at rest with AES-256 and in transit with TLS 1.2+.
- Locked down and tested
  Every dashboard user signs in with a one-time code, and roles decide who sees what. Independent testers scan and probe the platform regularly.

The details your security team will ask about

Role-based permissions. Each user gets the access their job needs.
One-time code sign-in. Every dashboard user signs in with a one-time code.
Encrypted identifiable exports. Reports with phone numbers or emails are encrypted with your public key, so only your designated people can open them.
Inactivate, don't delete. Departing users are inactivated, not deleted.
Separate environments. Production and test run in separate environments.

Encryption at rest. AES-256 via AWS KMS for production databases, storage, and secrets.
Encryption in transit. TLS 1.2 or higher.
Independent testing. Quarterly ASV scans and an annual independent penetration test.
Staff access. AWS, GitHub, and VPN access goes through SSO with MFA and least privilege.
Segmented network. Production and admin networks are separated and access-controlled.

Web application firewall. A web application firewall protects the platform.
DDoS protection. DDoS protection is in place.
Continuous threat detection. Automated threat detection monitors the cloud environment continuously.
Security posture checks. Cloud security settings are checked continuously against best practice.
Payment-page script monitoring. Scripts on payment pages are monitored for unauthorised changes.

Code analysis. Our builds include static and dynamic analysis.
Security awareness training. Our team is trained in security awareness on a recurring schedule.
Vulnerability scanning. The platform is scanned on a recurring schedule.
Documented policies. Security policies and procedures are formalised and documented.
Ongoing governance. Reviews, access checks, and risk management run on a fixed schedule to keep compliance current.

You decide how your members' data is used; we look after it on your behalf. Privacy rules are part of how your program runs.

Every member's consent is recorded when it's given or withdrawn, whether they sign up in the app, by SMS, or on the web.

On My Page, members see their data, edit their profile, manage consents, and ask to have their profile deleted.

Reports show a random member ID, not a phone number or email. Exports with contact details are encrypted for your designated people only.

Members sign in with a 6-digit code sent by SMS and manage their own data.

Information. Members can read the consent texts and the privacy policy.
Access. Members can see what data is held about them.
Rectification. Members can edit their profile details.
Erasure. Members can request deletion of their profile.
Restriction. Members can manage their consents and channel preferences.
Portability. Members can download their receipts, surveys, and redemptions as CSV.

You stay in control. You are the data controller; we are your data processor.
Active opt-in. Members opt in actively through the app, SMS, or web surveys.
Consent text on record. The platform can store which consent text was accepted.
Separate consents. Profiling and geolocation have their own consents.
Minimum age. Set a minimum age for joining your program.
Channel choice. Members can opt out of SMS or email and keep in-app messages.