Security

Payments: card data is handled entirely by Stripe (PCI DSS Level 1). MemberRoute never sees or stores card numbers.

Accounts: passwords are hashed (PBKDF2-SHA256), breached passwords are rejected, and owners and managers must use two-step verification. Sessions are short-lived, HttpOnly, Secure cookies.

Isolation: every record belongs to exactly one business and access is enforced server-side on every request, with automated cross-tenant tests.

Integrity: redemptions and adjustments are immutable ledger events; published plan versions can never be edited in place.

Operations: all privileged actions are audit-logged; the database has 30-day point-in-time recovery; webhooks are signature-verified and idempotent.

Report a vulnerability to the support email listed below. Please give us reasonable time to fix issues before disclosure.

Contact: support@memberroute.co