Security overview

Security at Comeback is owner-operated. We're a small team and we treat security as a core feature, not an afterthought. Here's the short version of what we do.

Encryption

• All connections to the dashboard and to our APIs use TLS 1.2 or higher.
• Customer and merchant data is encrypted at rest in our managed Postgres database (AES-256).
• Dashboard passwords are stored as one-way SHA-256 hashes. We cannot read or recover them.
• Apple Wallet passes are cryptographically signed using the certificate registered to your store.

Access & isolation

• Each merchant's data is logically isolated by store ID; queries are scoped on every request.
• Production access is restricted to the smallest possible team and requires hardware-key 2FA.
• We log every admin action against production systems.

Webhooks & integrations

• Shopify webhooks are HMAC-verified on every request. Unsigned payloads are rejected.
• The Comeback POS extension uses a shared secret your store can rotate at any time.
• Cron jobs (e.g. auto-reactivation) are protected by a per-environment bearer token.

Where it runs

Our infrastructure runs on Vercel (compute) and Supabase (Postgres + storage). Apple Wallet pass updates are pushed via APNs. Our Postgres lives in a Canadian region.

Backups & continuity

• Point-in-time recovery on the database with a 7-day window.
• Daily snapshots retained for 30 days.
• Static assets and wallet pass certificates are versioned in secure storage.

Reporting a vulnerability

If you've found something that looks wrong, please email security@tap2comeback.com before disclosing publicly. We'll acknowledge within 2 business days and won't pursue legal action against good-faith research.

Compliance roadmap

We're not SOC 2 certified yet. SOC 2 Type I is on the roadmap for 2026. In the meantime we're happy to walk you through our security posture on a call. Email security@tap2comeback.com.