Security

Integration Security

Last updated: November 12, 2026

API credential handling

LPK Rewards stores API credentials only in protected server-side environments. API keys, client secrets, wallet credentials, and supplier credentials must never be placed in frontend JavaScript, public repositories, client-side mobile builds, analytics tools, or customer-facing documents.

Sandbox and production separation

We test catalogue lookup, order creation, error handling, balance controls, and delivery flows in sandbox before requesting production access. Sandbox credentials, test balances, and test order data are kept separate from production systems and are not used for live customer transactions.

Access control

• Only authorized engineering and operations staff may access production credentials.
• Administrative access is reviewed when staff roles change or access is no longer required.
• Production systems use strong passwords, multi-factor authentication where available, and least-privilege access.
• Server IP allowlisting is used when supported by supplier or infrastructure controls.

Order controls

Orders are checked for approved business purpose, buyer authorization, available funding, unusual volume, duplicate recipients, high-risk destinations, suspicious denominations, and issuer restrictions before fulfillment.

Logging and incident response

We maintain operational logs for order status, API errors, delivery events, support requests, access changes, and suspicious activity. If credentials are suspected to be exposed, we rotate affected credentials, review recent activity, preserve relevant logs, and notify affected partners when required.

Data minimization

Recipient data is limited to the information needed to deliver and support rewards. We do not sell recipient information, and we do not use gift card recipient data for unrelated marketing.

Security contact

A company-domain security contact should be published before certification submission.