API keys are hashed, never stored
Keys are stored as SHA-256 hashes with timing-safe comparison. If our database were ever exposed, your key values couldn't be read from it. Rotate anytime from the dashboard.
Encrypted in transit and at rest
All traffic runs over TLS. Postgres (Neon) and Redis (Upstash) encrypt data at rest. There is no plaintext-credential path anywhere in the system.
Scoped, revocable access
API keys carry granular scopes (coupons, gift cards, referrals, loyalty, fraud) and can be revoked or rotated independently, with a grace window so rotation never breaks production.
Append-only money ledgers
Gift-card and loyalty-point ledgers are immutable at the database level — UPDATE and DELETE are rejected by triggers. Balances are always derived, never edited.
Rate limiting and fraud guard
Upstash-backed rate limiting on API routes, plus velocity rules, per-customer caps, and blocklists wired into the redemption path.
Idempotent, auditable operations
Redemptions are idempotent via Idempotency-Key, and every mutation writes an audit log entry. Retries are safe by design.
What we don't claim
We do not currently hold SOC 2, ISO 27001, or similar certifications. We won't claim them until we have them. What we do have: the practices above, 185 automated tests (including race-condition and ledger-immutability tests) run against every change, and a small attack surface — one product, one stack, no third-party scripts on the dashboard.
Vulnerability disclosure
Found a security issue? Email abdullah129026@fluxyai.codes with details and steps to reproduce. We'll acknowledge within 48 hours, fix as a priority, and credit you if you'd like. Please don't probe other customers' data — a report against your own account is enough.
Sub-processors
Data touches: Neon (Postgres), Vercel (hosting), Upstash (Redis), Resend (email), Paddle (billing). Full details in the DPA.