Security at Recognise Card

All traffic to and from the site is served over HTTPS (TLS 1.2+)with HSTS enforced. Data at rest — including verification documents and database backups — is encrypted using AES-256 by our hosting provider.

Accounts are protected by industry-standard password hashing (bcrypt), email-based sign-in, optional Google sign-in and per-user session tokens with automatic rotation. Every database table enforces Row Level Security, so members can only ever access their own records. Administrative access is limited to named staff and audit-logged.

Application and database are hosted in the European Union (Dublin, Ireland). Static assets and DDoS protection are delivered from Cloudflare's global edge. Payments are processed by Stripe. See our subprocessor list for the full picture.

Documents uploaded for eligibility checks are stored in a private bucket that is not publicly reachable. They are reviewed in up to 5 working days and the uploaded file is deleted as soon as the decision is made — the review record is kept for 30 days and then permanently purged. Only trained review staff can view them, and every access is logged.

We enforce strict Content Security Policy headers, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. All server endpoints validate inputs with strict schemas, sanitise free-text fields against XSS, and apply rate limits to prevent enumeration and abuse. Payment webhooks are verified with signed HMAC and constant-time comparison.

If you believe you have found a security vulnerability, please email us privately at security@recognisecard.ie rather than posting publicly. We aim to acknowledge reports within 3 business days and will not take legal action against good-faith security research conducted in accordance with this policy (no data exfiltration, no service disruption, no accessing accounts you don't own).