Looopin

Sicherheit und Mandantentrennung

Point mutations go through protected server functions and an append-only ledger. Wallet and SMS stay unlabeled as live until certified.

Tenant isolation

Each organization only sees its data — enforced with RLS and server checks, not UI hiding.

Balances change through audited server operations with idempotency keys to block duplicates.

Scan and redeem run as SECURITY DEFINER functions after validation — never trusted client math.

Sensitive actions are logged for admins without storing secrets or passwords.

Als live gelistete Funktionen sind angebunden. Wallet, SMS-OTP, SSO, White-Label und KI brauchen externe Freigaben und gelten nicht als fertig.