Security at Pointify

Your trust is our foundation. We use established security practices and well-understood encryption standards to protect your personal data, payment information, and loyalty credentials. The list below is what we actually do today — not aspirational.

Compliance & Certifications

PCI DSS Level 1

All payment processing is handled through Stripe, a PCI DSS Level 1 certified service provider. Your card details never touch our servers.

SOC 2 Type II Readiness

Our infrastructure and operational controls are aligned with SOC 2 Type II standards for security, availability, and confidentiality.

GDPR & CCPA Compliant

We respect your data rights under GDPR, CCPA, and other privacy regulations. You can request data export or deletion at any time.

TLS 1.3 Encryption

All data in transit is encrypted using TLS 1.3, the latest transport layer security protocol. We enforce HSTS and certificate transparency.

AES-256 Encryption at Rest

All stored data, including loyalty credentials and personal information, is encrypted at rest using AES-256, the same standard used by governments.

Infrastructure Security

Hosted on AWS with VPC isolation, WAF protection, DDoS mitigation via Cloudflare, and automated vulnerability scanning across our entire stack.

Our Security Practices

Beyond certifications, we maintain a comprehensive set of operational security practices.

Role-based access control (RBAC) for all internal systems

Automated secret rotation tooling (scripts/rotate-secrets.sh) with a credential matrix kept under version control

Continuous error + performance monitoring via Sentry across web, mobile, and every backend service

Documented incident response steps with a public commitment to notify affected users promptly when an incident is confirmed

Automated dependency vulnerability scanning via Dependabot, with security advisories surfaced as PRs

Code review and least-privilege deploys gated through GitHub branch protection

Data Handling

We collect only what we need and delete what we don't. Your loyalty program credentials are encrypted with AES-256 and stored in an isolated database with strict access controls.

Card numbers stored on our servers

AES-256

Encryption for data at rest

TLS 1.3

Encryption for data in transit

Responsible Disclosure

Found a vulnerability? We appreciate responsible disclosure. Please contact our security team at [email protected] and we will respond within 24 hours.

Pret a trouver votre meilleur tarif ?

Rejoignez les professionnels du voyage qui ne surpayent jamais. Compte gratuit en 30 secondes.

Creer un compte gratuit