Security at Rewardfinity

Rewardfinity uses layered controls designed for a small, internet-facing loyalty service. This page describes controls that are currently implemented; it does not claim a certification or audit that Rewardfinity has not earned.

Encryption

All public traffic uses HTTPS/TLS and strict transport security. Cloudflare D1 encrypts live databases, metadata, and recovery data at rest with AES-256. Shopify sessions, provider credentials, and imported gift-card credentials receive additional application-level AES-GCM encryption. API keys and one-time tokens are stored only as SHA-256 hashes.

Access control

Merchant access is isolated by merchant ID. Owner, staff, and member sessions have separate permissions and expirations; sensitive dashboard writes use CSRF protection. Owner accounts can enable time-based one-time-password authentication. Shopify requests and webhooks are authenticated and requested scopes are kept to the minimum required.

Integrity, auditability, and data minimization

Loyalty balances come from an append-only integer ledger. Duplicate commerce events are idempotent, redemptions use an atomic guarded write, and security-sensitive merchant actions create audit records. The Shopify app requires only Shopify's read_orders scope; merchants who turn on POS reward redemption can separately grant the optional read_customers and write_discounts scopes. Rewardfinity does not collect payment-card or shipping-address data.

Backups and recovery

Cloudflare D1 provides encrypted point-in-time recovery. Rewardfinity does not copy live customer data into developer machines or use production customer records as test fixtures. Production and automated test databases are separate.

Incident response and monitoring

Health checks cover the API and database, scheduled reconciliation retries failures, and webhook processing records delivery outcomes without logging secrets. A suspected incident is triaged, contained, investigated, and remediated; affected merchants and authorities are notified when required. Current availability is published on the service status page.

Vulnerability disclosure

Please report a suspected vulnerability privately to info@rewardfinity.com with “Rewardfinity security report” in the subject. Include the affected URL, reproduction steps, and impact. Do not access other people's data, disrupt service, or publish the issue before a fix is available. We will acknowledge a valid report as soon as practical and coordinate remediation.