Security

Overview

DealCraft is designed to collect as little personal data as a promotion needs. Results are decided on the server, network addresses are never stored in raw form, and every business's data is kept separate from every other business's data.

Hosting

The service runs on Oracle Cloud in the Abu Dhabi region of the United Arab Emirates. The database runs on the same server and is not reachable from the internet. Traffic reaches the application only through a web server that moves every connection to encrypted HTTPS.

How data is protected

Data in transit is encrypted with TLS. Passwords are stored as salted scrypt hashes; API secret keys are stored as SHA-256 hashes and shown only once, when they are created; webhook signing secrets are encrypted with AES-256-GCM.

A visitor's network address is shortened to its network block and stored only as a hash made with a secret key, so it cannot be turned back into an address. Every database query for a business's data must name that business, and the data layer refuses queries that do not.

Access

Only the operator has access to the production servers and the database. Staff at a business mark rewards used through a separate PIN-protected screen that can see nothing else, and devices can be revoked at any time.

Fair and tamper-proof games

The result of every play is decided and recorded on the server before the game shows it. Each play uses a single-use token, and the budget and winner limits are checked in the same database operation that records a win, so they cannot be exceeded even under heavy traffic.

Backups

The database is backed up every day. Backups are kept for five days on the server and for 30 days in a private Oracle Cloud Object Storage bucket in the same region, which Oracle encrypts at rest.

If something goes wrong

If a personal data breach affects a business's data, we notify that business without undue delay and within 48 hours of becoming aware of it, as the Data processing agreement requires, and we notify authorities where the law requires.

Reporting a vulnerability

If you find a security problem, write to hello@dealcraft.io with the details. Please give us reasonable time to fix it before disclosing it publicly and do not access other people's data while testing. We will not take action against good-faith research that follows these rules.

Insurance

DealCraft does not currently hold cyber liability insurance. If that changes, this page will say so and name the insurer and the cover.

What we do not have yet

DealCraft does not hold a SOC 2 or ISO 27001 certification and runs in a single region. We describe our measures openly instead, and we answer security questionnaires on request.