Trust is a record, not a badge.

OAuth access and refresh tokens are configured for application-level encryption. Stored webhook secrets use AES-GCM. API credentials are stored as one-way hashes, carry environment-bound scopes, and can be revoked. Deleted-member suppression and automatic maintenance each require a separate server-only, non-placeholder secret of at least 32 characters. The suppression secret must remain stable unless a governed token re-hash migration is performed.

Internal tests cover webhook secret encryption/decryption and signed delivery behavior. Widget session codes are hashed, short-lived, and exchanged for permission-bound signed sessions.

Key custody, rotation operations, infrastructure encryption, network controls, dependency risk, and the deployed attack surface require an independent architecture review and penetration test.

The merchant console supports Google, Apple, and ChatGPT-backed sign-in. Organization membership is separate from identity, role-to-action rules gate operator changes, and API credentials are restricted by environment and scope.

Console sessions use an eight-hour idle expiry, a 30-minute refresh cadence, and a 15-minute freshness window for sensitive actions. These are product defaults, not a claim of organization-configurable enterprise session policy.

Organization owners and administrators can export a CSV of operator identity, email, effective role, ownership or membership source, and relevant timestamps. The export action creates an audit event; it is evidence input, not a completed periodic access-certification workflow.

Automated internal tests exercise role boundaries, including separation between finance and risk actions, and permission checks around widget publishing and redemption enablement. Adjustment approval also compares an immutable stable human or service principal: another credential bound to the requester's same principal cannot approve, and an unbound legacy credential fails closed until rotated.

SAML or OIDC enterprise SSO, SCIM, organization-enforced MFA, configurable session policy, IP restrictions, periodic access certification, emergency-access procedures, customer-managed keys, and a documented SIEM feed are not represented as available here.

Existing objects addressed by merchant mutations are checked against both organization and environment ownership before use. Sandbox and production have separate identifiers and credentials.

Internal tests attempt cross-organization and cross-environment object access across supported resource types and verify rejection, alongside same-tenant success cases.

Source-level gates are not a substitute for a deployed architecture review, adversarial tenant testing, database policy review, and ongoing access-log analysis.

Supported write APIs require idempotency keys, bind repeat requests to the original operation, and return trace identifiers. Ledger postings use balanced debit/credit lines, database constraints reject invalid amounts, and reversals preserve the original record instead of overwriting it. Member identity creation is separate from explicit program enrollment; value-entry mutations recheck active enrollment at the database write boundary. Governed unenrollment requires zero available, pending, and reserved balances and retains financial and consent history.

Internal tests cover balanced earning and redemption, invalid ledger lines, repeated requests, returns, point-lot allocation, rate limits, tenant boundaries, finite inventory guards, permission-bound redemption, exact large-integer close arithmetic, member roll-forward exceptions, double-entry exceptions, and canonical evidence hashing.

The public ledger-close report is scoped to one program and one half-open period. It returns decimal-string point totals, movement by event type, finance-policy assumptions, journal mapping, readiness checks, and a SHA-256 evidence hash. It explicitly marks itself as system-generated, not independently audited and not a contractual financial statement.

Add published concurrency, replay, out-of-order event, expiration-batch, import/export, and failure-injection reports using a workload tied to an actual buyer’s expected peak.

Request IDs, audit events, reversible credential state, rate limiting with Retry-After guidance, reconciliation concepts, and production-readiness gates support controlled operation and investigation. The checked-in worker also runs bounded maintenance after API traffic and from a per-minute scheduled trigger. A D1 per-environment lease prevents overlapping workers from owning the same sweep, and records last start, successful completion, and bounded error evidence. It requires a dedicatedMAINTENANCE_SECRET and safely does no work when the secret is missing or a placeholder.

Document the backup scope and cadence, run a measured restore drill, record recovery dependencies, define evidence-based RPO/RTO, and exercise provider or regional failure before making resilience commitments.

No public uptime history, contractual SLA, backup restoration result, RPO/RTO, multi-region failover claim, or disaster-recovery exercise is established here. Source-level scheduling does not prove deployed cron execution, maximum processing or delivery time, external monitoring, or paging. Buyers should treat these as open production gates.

Member records carry consent state, consent events preserve changes, and member API responses are marked no-store. Public Academy credentials are created only after explicit publication consent and retain the captured consent version.

A dedicated least-privilege operation tombstones the member profile, scrubs known structured identifier copies from operational records, and governance-scrubs stored idempotency receipt response snapshots that contain those identifiers while retaining the receipt's operation identity. Governed ledger, transaction, consent, and audit history remains explainable; merchant-supplied references or evidence remain governed by the merchant's retention policy. The operation does not promise global de-identification of arbitrary free text. Suppression tokens use a dedicated stable server-onlyPRIVACY_SUPPRESSION_SECRET of at least 32 non-placeholder characters. Public materials do not claim customer-managed key custody or an independently validated rotation ceremony.

Publish a data inventory, purpose and retention schedule, deletion and correction process, subprocessor register, cross-border treatment, and a data-processing agreement suitable for buyer review.

Data deletion, retention enforcement, subject-request handling, legal-basis mapping, and subprocessor controls need legal review and operating evidence; no privacy certification is claimed.

A dedicated exports:read scope can produce a versioned, tenant-scoped JSON bundle. Its manifest declares the included collections and exclusions, and every export request is audited. Public API 1.13 also stages, inspects, and applies member opening balances in resumable, idempotent chunks without overwriting existing members. The published schemas—not a marketing list—define both portable records.

Internal contract tests cover stable ordering, pagination, organization and environment scoping, nested secret removal, URL-credential redaction, sensitive collection exclusions, and the required migration dataset.

A buyer should perform a timed export, independently reconcile it, rebuild required state outside Loyumi, and verify contractual data-return and deletion duties before production adoption. Exact cross-request export snapshots, historical transaction and configuration import, independent reconstruction, and verified deletion remain open evidence.