security
Nothing to hide.
Everything locked.
our security posture, in plain language — no badge-borrowing, no vague “bank-grade” claims.
CARD PAYMENTSprocessed end-to-end by our payment provider. card numbers never touch our servers — we hold a token, they hold the vault.
REWARD CODESencrypted at rest with envelope encryption. decrypted only at the moment the claim-link holder reveals them. codes are the crown jewels of this database and are treated that way.
CLAIM LINKSunguessable single-use tokens. unclaimed value is automatically refunded to your balance after 90 days — links don't live forever.
YOUR RECIPIENTS' DATAemails are used for delivery and reminders, nothing else. no marketing to your people, no resale, deletion on request. gdpr / uk-gdpr.
YOUR MONEYprefunded balances are ledgered per client and withdrawable at any time. we are a reseller of rewards, not a bank — we never hold funds longer than the job needs.
SOC 2control set in progress, not yet audited — we say so rather than borrow a badge. happy to walk through current controls on a call.
FOUND SOMETHING?report a vulnerability to admin@ccpay.agency with 'security' in the subject. we respond fast and we don't shoot messengers.
PROCUREMENT QUESTIONS? WE'LL ANSWER THEM LIVE.BOOK 15 MINUTES