Security
How we keep your customers' information safe.
Last checked 8 September 2026. Questions: abid@keporia.ca.
A loyalty card that lives in your customers' phones means you are trusting Keporia with your customers. This page says exactly what that trust involves — what we hold, where it is, who can see it, what we tested, and what we promise in writing — in plain words, with the proof attached. Everything here was checked on the live system in September 2026, and we re-check it every week.
Facts at a glance
| What we ask a customer for | A first name. No surname, no email, no phone number, no birthday, no payment card. |
|---|---|
| Where records are stored | Toronto, Canada (Fly.io, region yyz). Records never leave Canada, which removes the cross-border question under PIPEDA. |
| Who can see a shop's customer list | The shop owner, through their owner page; Keporia (one person), for support; nobody else. One shop's list is kept apart from every other shop's — tested, not just promised. |
| Independent security scan | A+ — the top grade — on both keporia.ca and card.keporia.ca (securityheaders.com, 7 September 2026; images below). |
| Penetration test | Run on the live system on 6 September 2026, two passes. No way found for an outsider to read or change anyone's data. One denial-of-service weakness found and fixed the same day. |
| Backups | Automatic daily snapshots, kept in Canada. Restore tested on 7 September 2026 — a snapshot was restored to a separate server, opened, and verified intact, then destroyed. |
| Tracking | None. keporia.ca sets no cookies, runs no analytics, and loads nothing from any third party — not even fonts. |
| If a customer asks to be forgotten | Erased, normally the same day — the record, the visit log, the card's update link and the Google Wallet card. |
| If something ever goes wrong | You hear from us within 72 hours. It is in the contract, not just on this page. |
| Report a security concern | abid@keporia.ca — you will get a reply from the person who runs the system, not a ticket number. |
What we hold about your customers
A first name, a member number, how many stamps they have, and a record of each stamp and reward with the time and the door where it happened. That is the whole list. There is nothing that would let anyone contact, find or identify your customers outside your shop. We do not collect location: a card can carry your shop's address so the customer's phone shows the card nearby, but that decision is made on the phone by Apple or Google, and nothing about the customer's whereabouts is ever sent to Keporia or to you.
Can a customer cheat the card?
No. The stamps don't live on the phone; they live in our database. The card in the wallet is a digitally signed copy of that record, and Apple and Google refuse to install a card that has been edited. A stamp can only be added at your counter, by your staff, with a PIN. A screenshot of a "full" card gets nobody a free coffee.
Proof 1 — independent scan: A+ on both sites
securityheaders.com is a free public tool run by Snyk, a security company. It checks how well a website protects the browsers of the people who visit it. It is independent of us, and you can run it yourself in ten seconds: type keporia.ca or card.keporia.ca into it. A+ is the highest grade it gives.
What those six protections mean: the browser will only talk to us over an encrypted connection; only code we wrote can run on the page (no outside scripts, no trackers, no ad networks); our pages can't be hidden inside someone else's site to trick a click; the browser can't be fooled into treating a file as something it isn't; we don't hand the next website the address a customer came from; and our pages may not use the camera, microphone, location or payment features — except the staff counter page, which scans cards.
Proof 2 — we tried to break in
A penetration test is when you attack your own system the way a criminal would, to find the holes before they do. Ours was done in two independent passes on 6 September 2026, on the live system, and every finding was fixed and re-tested before the day was out. In plain terms, here is what we tried and what happened:
| The attack | Result |
|---|---|
| Open every one of the system's web addresses without a key | Blocked. Every address that touches data demands a secret, a PIN, a token or Apple's own pass credential. |
| Read one shop's customer list while holding another shop's key | Blocked. Every lookup is fenced to the shop it belongs to. |
| Guess a staff PIN by trying thousands of combinations | Blocked. Five wrong tries locks that address out for five minutes, and we proved the lock can't be dodged by faking the address. |
| Forge a customer's identity to see or redeem their card | Blocked. Identity is a long random token, never the member number printed on the card. |
| Edit a card on the phone to add stamps | Impossible by design. The card is digitally signed; a changed card won't install. |
| Trick the server into showing files, running commands or leaking errors | Blocked. Every input is checked; errors say nothing useful to an attacker. |
| Overload the server so real customers can't use their cards | One weak spot found — a page that made the server work hard on every visit. Fixed the same day (about 50× faster now) and rate limits added per address. |
Proof 3 — the backups work
"We have backups" means nothing until someone has restored one. On 7 September 2026 we took the newest daily snapshot of the customer database, restored it to a separate server in Toronto, opened it, ran a full integrity check (result: ok), confirmed the record counts matched the live system, and then destroyed the copy. We have a repeatable procedure for it and run it again before any client audit. The honest numbers to plan around: snapshots are daily, so at most one day of stamps could be lost in a disaster; recovery takes minutes.
How the keys are kept
The certificates that sign your customers' cards, and the passwords to our servers, are never stored in our code, never sent by email or chat, and never kept on a laptop. They live in the hosting provider's encrypted secret store, and the signing keys are also held in an encrypted offline archive. Every account that can touch the system — hosting, code, Apple, Google, the domain — has two-factor authentication turned on. Access tokens are scoped to the one thing they need to do and expire.
What we promise in writing
- Your customer list is yours. You can have a copy any time, free, within ten business days.
- If a customer asks to be forgotten, we erase them — normally the same day.
- If anything is ever accessed without permission, you hear from us within 72 hours.
- If you leave, you take your list and your card design with you.
The full wording is in the service terms and the privacy policy.
What we do not claim
We have not yet had an outside security firm test us (planned once we have about ten clients). We hold no SOC 2 or ISO 27001 certificate — no café or pizza shop should pay for one, and we won't pretend otherwise. Keporia is one operator, in St. John's. We would rather tell you that than let you find out.
The full report
Everything on this page, with the detail and the dates, is in a seven-page report written for business owners: Keporia security and privacy report, September 2026 (PDF, 200 KB). Bring it to whoever signs off on your side; if they have a question it doesn't answer, email abid@keporia.ca.