Built for Trust & Compliance
Metro Cardz is designed with India's data protection regulations in mind. We take security seriously so your members' data stays private and your business stays compliant.
DPDP Act 2023 Aligned
Our data processing practices are designed to align with India's Digital Personal Data Protection Act 2023. Members' names, phone numbers, and DOBs are collected only for the stated purpose of running the merchant's loyalty programme.
Encryption at Rest & in Transit
All data is encrypted in transit using TLS 1.2+. Database fields containing PII (phone numbers, names) are stored in AES-256 encrypted columns in a managed cloud database hosted in India.
Merchant as Data Controller
Each merchant is the data controller for their own members. Metro Cardz acts as the data processor. Merchants can export or delete their member data at any time from the Settings panel.
JWT-Based Authentication
All API endpoints require signed JWT tokens with 15-minute access expiry and 30-day refresh tokens. Tokens are validated server-side on every request — never stored in cookies.
Rate Limiting & Abuse Prevention
Login, OTP, and public endpoints are protected by IP-level rate limiting via Redis. Failed logins are limited to 5/minute. OTP requests are limited to 3/minute per phone number.
Security Headers & CORS
All API responses include security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and HSTS in production. CORS is explicitly scoped to approved frontend origins only.
Role-Based Access Control
Platform enforces three roles: Super Admin, Merchant Owner, and Staff. Staff can only see their own merchant's data. Tenants are isolated at the database query level — not just the application level.
Error Monitoring (Sentry)
Application exceptions are monitored via Sentry with PII scrubbing enabled. No personal data is sent to error reporting services. Errors are logged by request path and type only.
Data Residency
Metro Cardz databases are hosted on managed PostgreSQL infrastructure located in India (Asia-South region). Member data does not leave India's borders during normal platform operation. Third-party integrations (WhatsApp via AiSensy, SMS via Msg91) process only the minimum required data (phone number + message text) through India-based API endpoints.
Responsible Disclosure
If you discover a security vulnerability in Metro Cardz, please report it responsibly to security@metrocardz.in. We will acknowledge your report within 48 hours and work to address valid vulnerabilities within 30 days. We do not pursue legal action against good-faith security researchers.