Where
All venue and member data is stored on Render in Frankfurt, Germany, inside the EU. UK law treats the EU as giving personal data the same protection as the UK does. Card images and static pages are served from the same place. Apple and Google receive what is on the card itself, as independent controllers of their Wallet services. The full list of companies that touch data, with regions and safeguards, is on the sub-processors page.
How
Every record belongs to one venue and the data layer refuses to answer without one. An automated test signs in as venue A and calls every route with venue B's identifiers on every build.
TLS 1.2 or later in transit with HSTS. Disk encryption at rest, plus application-level encryption of email, phone, birthday, push tokens and 2FA secrets, with a blind index for lookups.
No passwords. Email code, Apple or Google sign-in, then 2FA for owners and managers. Staff use a PIN that is hashed. Sessions can be revoked.
Every write is appended to an audit log. Our own staff reach member data only through a step-up with every view recorded.
Point-in-time recovery, with a restore drill each quarter.
Every dependency pinned, automated vulnerability alerts, weekly updates.
Not yet done
- No SOC 2 report of our own; our hosting providers hold theirs.
- External penetration test scheduled before public launch; the summary will be published here with the date.
- A data protection impact assessment is drafted and will be referenced here when complete.
- ISO 27001 is not planned for the first year.
Reporting a vulnerability
Email admin@storewallet.co.uk, or see /.well-known/security.txt. We acknowledge within two working days, keep you informed, and credit you if you wish. Please do not access other people's data while testing.
If something goes wrong
We notify affected venues within 48 hours of becoming aware of a personal data breach, with what we know and what we are doing, and we support the venue's own notification to the ICO within the 72 hours the law allows.