Loading...
Core security controls built into the platform
Tenant credentials encrypted at rest
PostgreSQL RLS on all tenant tables
API keys hashed before storage
Constant-time token comparison
Multiple layers of security protect your data at every level
Tenant credentials are encrypted at rest using AES-256-GCM. All traffic is encrypted in transit via TLS. API keys are hashed with bcrypt before storage.
Supabase PostgreSQL with Row-Level Security (RLS) enforced on all tenant tables. Every query is scoped to the authenticated tenant, preventing cross-tenant data access.
Five-tier RBAC model: super_admin, tenant_owner, tenant_admin, tenant_user, and partner. API route guards enforce permissions at every endpoint.
Structured audit logs for all critical actions including points transactions, redemptions, partner management, and configuration changes.
CSRF protection via cookie-based tokens with constant-time comparison. Rate limiting powered by Upstash Redis with fail-closed behavior in production.
Content Security Policy, HSTS, X-Frame-Options, and other security headers configured. Server-only guards prevent secret-bearing modules from leaking to the client.
Every code change goes through automated security checks before it reaches production.
npm audit runs in CI on every pull request to catch known vulnerabilities in dependencies.
TruffleHog scans every commit for accidentally committed secrets, tokens, and credentials.
Husky and lint-staged enforce linting and formatting checks before code is committed.
CI checks verify that all API routes use proper authentication and authorization guards.
Automated checks ensure Row-Level Security policies are applied to all tenant-scoped tables.
Critical operations like points awarding, redemptions, and refunds use PostgreSQL RPC functions for atomicity.
We believe you should have complete control over your data. Here's how we handle it.
We only collect and retain data necessary for providing our services.
Configurable retention policies with secure data deletion upon request.
Export your data anytime in standard formats. Your data belongs to you.
Data is stored in AWS us-west-2 (Oregon) via Supabase managed PostgreSQL.
LoyaltyHQ runs on Vercel's edge network for the application layer and Supabase managed PostgreSQL (AWS us-west-2) for the data layer. Payment processing is handled entirely by Stripe with webhook idempotency and replay protection.