Security at Refliqai
Refliqai moves money between businesses and their partners, so security is a product feature, not a page. Here is what protects your program data today.
Encryption at rest for sensitive data
Partner payout details (bank accounts, UPI IDs) and two-factor secrets are encrypted with AES-256-GCM before they reach the database. Admin screens only ever show masked values.
Account protection
Admin accounts support TOTP two-factor authentication with single-use recovery codes. Failed sign-ins trigger a per-account lockout, so credential stuffing cannot brute-force a password.
Hashed API credentials
Integration API keys are stored as SHA-256 hashes and shown exactly once at creation. Webhooks to your systems are signed with a per-app secret so you can verify every delivery.
Abuse and fraud controls
All endpoints are rate limited per client. Referral traffic is scored for self-referrals, disposable emails, duplicate identities, and abnormal velocity before any commission is approved.
Isolated, auditable data
Each tenant’s campaigns, partners, and payouts are scoped to their business account. Approvals, payouts, and settings changes are written to an audit log you can export as CSV.
Responsible disclosure
Found a vulnerability? Email security@refliqai.com and we will respond within two business days. Please include steps to reproduce; we credit reporters who wish to be named.
Questions about our security practices, data handling, or a vendor review questionnaire? Write to security@refliqai.com.