- Tenant isolation. Every record carries its venue, the data layer requires a venue for every query, and an automated test on every build signs in as one venue and attempts every route with another venue's identifiers, expecting refusal.
- Encryption in transit. TLS 1.2 or later with HSTS on every public endpoint, including the pass update service and the join pages.
- Encryption at rest. Provider disk encryption, plus application-level encryption of email, phone, birthday, device push tokens and 2FA secrets, with a blind index so lookups never decrypt in bulk.
- Authentication. No passwords. Email code or Apple or Google sign-in; two-factor authentication (an authenticator app or a passkey) required for owners and managers; for a passkey we store only its public key, never biometric data; staff PINs hashed; sessions revocable from the dashboard.
- Access control. Role-based: owner, manager, staff, partner. StoreWallet staff reach member data only through a step-up prompt that records who, what and why.
- Audit log. Append-only record of every write, retained twelve months, visible to the venue for its own data.
- Secrets. Held in the hosting provider's encrypted store, never in code; rotation runbook; certificate expiry monitored, with the Apple pass certificate renewed 60 days before expiry.
- Backups. Point-in-time recovery of the database; quarterly restore drill with the result recorded.
- Dependencies. Every dependency pinned; automated vulnerability alerts; weekly updates; builds fail on known critical vulnerabilities.
- Testing. External penetration test before public launch and annually; summary published on the trust page.
- Logging. Structured logs with no member email or phone; a scrubber removes them from error reports.
- Incident response. Detection through monitoring and alerts, triage, containment, notification to affected venues within 48 hours of awareness, support for their regulator notification, post-incident review published to affected venues.
- Personnel. Confidentiality obligations; least privilege; access removed the day someone leaves.
- Hardware. NFC chips locked at encoding; lost chips disabled server-side within a second.