Loyaltey

Security and data protection

Loyaltey stores the loyalty data of local businesses and their customers: names, email addresses, phone numbers, visits and rewards. This page describes the controls that are in place today, and is explicit about what we do not offer yet.

Encryption

  • All traffic is served over HTTPS, with HTTP Strict Transport Security in production.
  • Integration credentials (for example POS and marketing tool tokens) and other sensitive fields are encrypted at rest in the application with AES-256-GCM before they are stored.
  • Identifiers learned from point-of-sale systems, such as a POS customer ID or card fingerprint, are stored only as keyed HMAC-SHA256 hashes, never in plain text.
  • Cashier PINs are stored as bcrypt hashes.

Tenant isolation

  • Every business is a separate tenant. Queries on business-owned data are scoped to the authenticated business, and cross-tenant access is rejected.
  • Public pages (microsites, program pages, embed widgets) only expose what the business has chosen to publish.

Authentication and access

  • Business owners sign in with one-time email links; a new account must prove control of its email address before team invites and outbound messaging are allowed.
  • Customers sign in with email links, SMS codes or Vipps where available. Customers never need a password.
  • Staff at the counter use a cashier PIN, separate from the owner login.
  • Loyaltey staff accounts with admin access are protected with time-based one-time passwords (TOTP) and backup codes.
  • Sign-in, signup and other sensitive endpoints are rate limited.
  • Security-relevant actions (logins, exports, API key creation and revocation, permission changes) are written to an audit log.

Customer data and GDPR

  • Loyaltey acts as a data processor for the business; the business is the controller of its customers’ data.
  • Customers can download their data and delete their account themselves from the customer settings page.
  • Marketing consent is tracked per customer and per channel. Ad-audience uploads (Google, Meta) require a separate, explicit consent.
  • Consent collected by another loyalty platform is never carried over when customers are imported.
  • A Data Processing Addendum and the full subprocessor list are public.

Hosting and data location

  • The application runs on Railway, behind Cloudflare. Payments are handled by Stripe; Loyaltey never sees full card numbers.
  • Our subprocessor list states the location of each provider. Several, including the hosting provider, are located in the United States.

What we do not offer yet

  • No SOC 2 report or ISO 27001 certification.
  • No single sign-on (SAML or OIDC) for business accounts.
  • No choice of hosting region.

If any of these is a requirement for you, tell us before you sign up.

Documents and contacts

Try Loyaltey free

The Starter plan is free for up to 100 customers, with no credit card. Growth is €29/month for up to 2,500 customers.