Security & Compliance
Your customers' data and your business data are protected at every layer. Here's how we keep Kudo Rewards secure.
HTTPS
Traffic encrypted in transit
Hashed passwords
Never stored in plaintext
Role-based access
Owner, manager and staff roles
GDPR
DPAs available on request
Stripe payments
No card data stored by Kudo
SLA
Available on custom plans
Data Encryption
Traffic between your browser, the Kudo apps and our servers is encrypted over HTTPS. Account passwords are stored hashed, never in plaintext.
Access Control
Role-based access for business owners, managers and staff, so each team member only gets the access their role needs.
Audit Logging
Platform administration actions are recorded in an audit log, so changes can be traced back to who made them and when.
Infrastructure
Kudo is built on reliable cloud infrastructure with access limited to authorised personnel. Details of hosting are available on request.
Vulnerability Management
We keep the platform and its dependencies up to date and welcome reports from security researchers through responsible disclosure.
Compliance
Kudo is designed with UK and EU GDPR in mind. Data processing agreements (DPAs) are available on request.
Security FAQ
Where is my data stored?
Kudo is hosted with an established cloud provider. Contact us if you need details of hosting locations for your own compliance requirements.
Can I delete my data?
Yes. Contact us to request a copy or deletion of your business and customer data.
How do you handle security vulnerabilities?
We operate a responsible disclosure policy. If you discover a vulnerability, please contact contact@kudorewards.co.uk and we will respond as quickly as we can.
Is Kudo Rewards PCI compliant?
Kudo Rewards does not store, process, or transmit cardholder data. Payment processing is handled entirely by Stripe, which is PCI DSS Level 1 certified.
Report a vulnerability
We operate a responsible disclosure programme. If you find a security issue in Kudo Rewards, please email us. We will acknowledge your report and keep you updated while we investigate.