Security

Last updated October 22, 2026

Payments: card data is handled entirely by Stripe (PCI DSS Level 1). MemberRoute never sees or stores card numbers.

Accounts: passwords are hashed (PBKDF2-SHA256), breached passwords are rejected, and owners and managers must use two-step verification. Sessions are short-lived, HttpOnly, Secure cookies.

Isolation: every record belongs to exactly one business and access is enforced server-side on every request, with automated cross-tenant tests.

Integrity: redemptions and adjustments are immutable ledger events; published plan versions can never be edited in place.

Uploads: logos and fonts are checked by their actual file contents (SVG and other scriptable formats are refused) and served with strict security headers.

Operations: all privileged actions are audit-logged; the database has 30-day point-in-time recovery; webhooks are signature-verified and idempotent.

Messaging: members can send plain text only - links, images and attachments are refused, messages are capped in length and rate-limited, and every thread is scoped to one business. Staff tokens for Twilio are encrypted with the same key as two-step secrets. Push notification payloads are encrypted per RFC 8291, so push services relay them without being able to read them.

Report a vulnerability to the support email listed below. Please give us reasonable time to fix issues before disclosure; we won’t take action against good-faith research that avoids harming people or their data.

Contact

Plainwork Software (MemberRoute) · support@memberroute.co