Security
Your members trust you. You can trust us.
Membership data includes names, addresses, payments and sometimes information about children. We treat it accordingly.
How we protect your data
- Regional data hosting
- Organizations are hosted in the United States or the European Union, and their data stays in that region.
- Encryption everywhere
- Data is encrypted in transit with TLS and at rest with AES-256.
- Payments handled by Stripe
- Card details go directly to Stripe and never touch our servers. Stripe is a PCI DSS Level 1 service provider.
- Organization isolation
- Every record is scoped to its organization and enforced at the database level, not only in application code.
- Access controls
- Granular admin roles, two-factor authentication, passkeys and a full audit log of admin activity.
- Backups and recovery
- Continuous backups with point-in-time recovery, tested regularly.
- Least-privilege staff access
- Staff access to customer data is limited, logged and requires two-factor authentication.
- Independent testing
- Regular third-party penetration tests and automated vulnerability scanning.
- Privacy by design
- We are a processor for your member data. We never sell it or use it for advertising.
Report a vulnerability
If you believe you have found a security issue, please email us. We will acknowledge your report within two business days and keep you updated as we investigate.
Give your members a card they will actually carry.
Start free in minutes. Bring your members across from a spreadsheet or another system, and send everyone a Wallet card on day one.