Security

Security at Flicp is a continuous engineering discipline, not a point-in-time certification exercise. We apply defence-in-depth across infrastructure, application, and operational layers.

• Authentication: Passwords hashed with bcrypt (minimum 12 rounds). Session tokens are signed JWTs with configurable expiry and Redis-backed revocation.
• Data Protection: Private wallet keys encrypted with AES-256. All data in transit over TLS 1.2+.
• Access Control: Role-based access control (RBAC) across all surfaces. Principle of least privilege enforced at the database and API layer.
• Application Security: CSRF protection, rate limiting, Sec-Fetch-Site header enforcement, parameterised queries (Sequelize ORM), and input validation at all API boundaries.
• Record Integrity: Coupon lifecycle events are written to an immutable private ledger. Flicp's consensus setup provides tamper evidence without requiring customers or brands to interact with cryptocurrency.
• Audit Logging: All authenticated mutating requests are logged with actor, timestamp, IP address, and HTTP context. Logs retained for 2 years.

If you discover a security vulnerability in Flicp, please report it responsibly to help@flicp.com. We will acknowledge within 24 hours and provide a resolution timeline. We ask that you do not publicly disclose the vulnerability for at least 90 days while we work on a fix.

Flicp does not pursue legal action against researchers acting in good faith under this policy.