Security
Your customers' data is safe with us
A loyalty program runs on trust – yours and your customers'. Here is a plain, no-marketing overview of how we protect their data, where it is stored and what you can do with it.
How we protect data
-
Data stays in the EU
The database and the app run in Ireland, in data centres in the European Union. So do the nightly backups.
-
Each business sees only its own data
Isolation between businesses is enforced by the database itself with row-level security (RLS), not just by the app. Automated tests check it on every code change.
-
Encrypted in transit and at rest
All traffic goes over HTTPS and the database is encrypted on disk. We never store passwords in readable form, only their hash.
-
Sign in without a password
You can sign in to the portal with your fingerprint or face (passkey). A passkey can't be guessed or phished by a fake e-mail.
-
Nightly encrypted backups
Every night we back up the whole database. The backup is encrypted with a key only our team holds, stored outside the database in EU storage and kept for 30 days.
-
Regular updates
We update the app's libraries and runtime regularly and roll out security fixes as soon as possible after they are released.
Your data belongs to you
You are the controller of your customers' data; Walio processes it only on your instructions. The terms are set out in the data processing clause of our Terms of Service.
- You can download your customer list as a CSV from the portal at any time.
- If a customer asks, you can delete them yourself in the portal. For complete removal from our database too, write to podpora@walio.cz and we will handle it within one month.
- When the contract ends, we delete the data within 30 days or hand it over to you.
- We only collect what you set up: name and e-mail, optionally phone and date of birth. Customers don't need to install any app.
- We don't sell data. The services that help us run Walio are listed in our Privacy Policy.
- You enter your payment card directly with the Stripe payment gateway; the card number never reaches us.
- If there were ever a security breach, we would let you know without undue delay.
Frequently asked questions
In Ireland, in the European Union – that is where the database, the app and the nightly backups run. Some services needed to run Walio (Apple and Google Wallet, e-mail delivery) may also process data outside the EU; which ones and on what basis is set out in our Privacy Policy.
No. Each business sees only its own customers and their cards. This is enforced by the database itself, so not even a bug in the app can show another business's data. Automated tests verify it on every code change.
Every night we back up the whole database, encrypt the backup and store it outside the database in EU storage. We keep backups for 30 days, so data can be restored even after an incident we only notice a few days later.
Yes. You are the controller of your customers' data and Walio processes it only on your instructions, under the data processing clause in our Terms of Service. How to inform your customers about the processing is covered in the article Loyalty programs and GDPR on our blog.
Found a security issue?
Please write to us directly rather than publicly. We will get back to you and look into it as soon as possible.