Loyalty data is transaction data. It tells you where someone eats, stays and shops. We treat it accordingly — hosted in region, access controlled, logged end to end, and exportable by you at any time.
Last updated 1 January 2026GCC hosting by default, with market-specific data residency where a client or regulator requires it.
TLS in transit, AES-256 at rest, and secrets held in a managed vault rather than in code.
Every adjustment, rule change and export is attributable to a person and a timestamp.
Full export on request, deletion on termination, and no use of member data for our own purposes.
Your security team can have this as a completed questionnaire — ask and we will send it.
On-call escalation runs 24/7. The first job is containment and preserving evidence, not explanation.
Affected clients are notified with what we know so far, in hours rather than days — and updated as we learn more.
A written post-incident report with root cause, impact and the fix, shared with every affected client.
Report it to us privately and we will acknowledge within one working day. We do not pursue researchers who act in good faith.
Architecture overview, sub-processor list, data flow diagrams and a completed vendor questionnaire — sent under NDA to your security team.
