Effective 18 July 2026 · Rewardfinity is operated by an independent developer in Ontario, Canada · contact: singhanhad78@gmail.com
Rewardfinity uses layered controls designed for a small, internet-facing loyalty service. This page describes controls that are currently implemented; it does not claim a certification or audit that Rewardfinity has not earned.
All public traffic uses HTTPS/TLS and strict transport security. Cloudflare D1 encrypts live databases, metadata, and recovery data at rest with AES-256. Shopify sessions, provider credentials, and imported gift-card credentials receive additional application-level AES-GCM encryption. API keys and one-time tokens are stored only as SHA-256 hashes.
Merchant access is isolated by merchant ID. Owner, staff, and member sessions have separate permissions and expirations; sensitive dashboard writes use CSRF protection. Owner accounts can enable time-based one-time-password authentication. Shopify requests and webhooks are authenticated and requested scopes are kept to the minimum required.
Loyalty balances come from an append-only integer ledger. Duplicate commerce events are idempotent, redemptions use an atomic guarded write, and security-sensitive merchant actions create audit records. Rewardfinity requests Shopify's read_orders scope only and does not collect payment-card or shipping-address data.
Cloudflare D1 provides encrypted point-in-time recovery. Rewardfinity does not copy live customer data into developer machines or use production customer records as test fixtures. Production and automated test databases are separate.
Health checks cover the API and database, scheduled reconciliation retries failures, and webhook processing records delivery outcomes without logging secrets. A suspected incident is triaged, contained, investigated, and remediated; affected merchants and authorities are notified when required. Current availability is published on the service status page.
Please report a suspected vulnerability privately to singhanhad78@gmail.com with “Rewardfinity security report” in the subject. Include the affected URL, reproduction steps, and impact. Do not access other people's data, disrupt service, or publish the issue before a fix is available. We will acknowledge a valid report as soon as practical and coordinate remediation.