Security & Data Protection

🔒 Australian Privacy Act 1988

FidiPerks complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Specifically:

• We collect only the personal information necessary to operate the loyalty platform (APP 3).
• We use and disclose personal information only for the purpose for which it was collected, or a directly related purpose (APP 6).
• We maintain a clearly accessible Privacy Policy explaining how data is collected, used, and disclosed (APP 1 & APP 5).
• Individuals may request access to, or correction of, their personal information at any time (APP 12 & APP 13).
• We do not sell personal data to third parties for marketing purposes.

For the full detail of how we handle personal information, see our Privacy Policy.

🇦🇺 Data Residency

All production data — including merchant profiles, customer loyalty records, transaction history, and analytics — is stored in Australia (AWS Sydney). Some data is sent overseas where a service needs it: members' email addresses and device identifiers to our push and email delivery provider, merchants' billing details to our billing provider, and, for merchants who use the Marketing Agent, their business content to AI and social publishing providers. Each provider, the data it receives and where it is processed is listed on our sub-processors page.

🔐 Encryption & Transport Security

• In transit: All communications between clients and FidiPerks servers are encrypted with TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS.
• At rest: Customer and merchant data is encrypted at rest using industry-standard AES-256 encryption.
• Passwords: User passwords are hashed using a modern adaptive hashing algorithm (bcrypt). Plaintext passwords are never stored.
• API tokens: Bearer tokens are short-lived and rotated on re-authentication. Secrets are stored in environment-isolated secure vaults, never in source code.

👤 Access Control

• Merchant data is strictly isolated by tenant — one merchant cannot access another merchant's data through the API.
• Admin and staff roles within a merchant account are enforced at the API level, not just the UI.
• Internal FidiPerks staff access to production data is limited to authorised personnel and is logged.
• Multi-factor authentication (MFA) is available and recommended for merchant admin accounts.

🚨 Incident Response & Breach Notification

In the event of a data breach or security incident, FidiPerks follows a documented incident response procedure:

• Detection: Automated alerting monitors for anomalous access patterns and system errors 24/7.
• Containment: Affected systems are isolated within hours of a confirmed incident.
• Notification: If a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals within 30 days of becoming aware of the breach, in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988.
• Post-incident review: A root-cause analysis is conducted within 14 days and remediation actions are tracked to completion.

🔗 Key Sub-processors

FidiPerks uses a small set of third-party services to deliver the platform: AWS for hosting (in Australia), OneSignal for push and campaign email delivery, Chargebee for merchant billing, Cloudflare for website bot protection, and — only for merchants who use the Marketing Agent — Anthropic, Google, Twilio and a social publishing provider.

The full list, with the personal data each provider receives, where it is processed, and a change log, is on our sub-processors page. Enterprise customers can request a data processing agreement at support@fidiperks.com.

📣 Responsible Disclosure Policy

If you discover a potential security vulnerability in FidiPerks, we ask that you report it to us privately before public disclosure, giving us a reasonable opportunity to investigate and remediate.

🏢 Enterprise & Procurement Enquiries

If you are evaluating FidiPerks for an enterprise deployment or integration and require additional documentation — such as a Data Processing Agreement (DPA), a completed vendor security questionnaire, or evidence of specific controls — please reach out directly.