Security

We're a small team, still in a pilot stage with a small number of merchants — so we'd rather tell you plainly what we do today than claim certifications we don't hold. This page describes the actual practices in place now, and what's planned next.

Infrastructure

The platform runs behind an outbound-only tunnel — there are no directly exposed inbound ports on the server itself. All traffic to Smiles Rewards is encrypted in transit over HTTPS/TLS, terminated at the network edge before reaching our infrastructure.

Tenant isolation

Every merchant's data is scoped to that merchant alone at the data-model level — there is no query path in the platform that can return one merchant's customer or loyalty data as part of another merchant's request. This is an architectural property of how the system is built, not just an access-control check layered on top.

Data at rest

Merchant and customer data is stored in a managed database on encrypted cloud storage. We don't store payment card data — payments and checkout remain entirely inside the merchant's own Odoo or Shopify systems; we only mirror the loyalty-relevant fields those systems already expose.

Access controls

Access to the admin dashboard and to merchant configuration is authenticated and limited to the team members and merchant admins who need it. Credentials for connecting a merchant's Odoo or Shopify account are never connected to production without the merchant's explicit confirmation, and staging or test connections are used first wherever possible.

What's on the roadmap

An on-premise deployment tier — for merchants who need customer data to never leave their own Odoo instance — is planned for after the pilot stage. As we move past pilot scale, we expect to formalize the practices above into a documented security program and pursue relevant third-party attestations; we're not there yet, and won't claim to be.

Reporting a security issue

If you believe you've found a security vulnerability in Smiles Rewards, please email [email protected] with details. We ask that you give us a reasonable window to investigate and fix an issue before disclosing it publicly, and we won't take legal action against good-faith security research conducted in that spirit.