Separate, signed and accounted for.
Balances are money-shaped data. This is how Loyalty Pilot keeps each application's points apart, proves where events came from, and records every movement.
Each application is isolated
- Every application is its own tenant. Its customers, balances, rules and ledger are invisible to every other application, including your own.
- Isolation is enforced in the data layer: every query is filtered to the calling application, so it does not depend on each feature remembering to filter.
- Test and Live are separate applications, so test traffic can never reach live customers.
Credentials are per application
- Applications authenticate with OAuth 2.0 client credentials, issued by our identity service.
- A secret is shown once, when it is created. Store it in your secret manager; we cannot show it again.
- People sign in to the console with OpenID Connect and PKCE.
Webhooks are signed
- Every delivery carries an X-Loyalty-Signature header: an HMAC-SHA256 of the exact request body, keyed with that subscription's secret.
- Verify it against the raw body with a constant-time comparison before trusting the payload.
Every point is on the ledger
- Each movement is recorded as a transaction with the balance after it and your own reference.
- Awards accept an idempotency key, so a retried request never awards twice.
- Redemptions that cannot be fulfilled are reversed with a new entry, never by editing history.
We need very little about your customers
- A programme runs on your own customer id. Loyalty Pilot does not need names, email addresses or payment details to work.
Found a security issue? Please tell us privately before disclosing it. The documentation covers verifying webhooks and handling credentials in detail.