Data Protection, Security & Infrastructure
About your data, what we do with it & where it lives
Updated: January 31, 2024
Punchpass hosts data from both our clients, as well as their customers. We take this responsibility seriously, not just because it's the law, but because it's how we would want our data handled. Below are more details about how we handle your data to keep it safe and secure.
Your data is your data
Punchpass provides tools to help clients get their data out of Punchpass should they choose to – we believe it's your data. We never charge a fee to download any of your data.
Data may remain on Punchpass
Your data may continue to reside on our servers after your account has canceled/expired for our own internal reporting purposes only. The account owner may request to have all of your company data removed at any time.
We do NOT sell data
Call us old-school, but we make money by charging our clients a monthly fee. We do not, under any circumstances, ever sell data to 3rd party services for marketing or any purpose.
We DO send data to 3rd party services to run Punchpass
Any modern web application uses a number of different specialized applications in order to serve their customers, and we are no different. For example we use Intercom for customer support, Honeybadger & Datadog for error tracking, Stripe to process credit card payments, and Postmark to send transactional emails. Our service is hosted on Amazon Web Services (more info below.)
These services help Punchpass run more reliably, efficiently, and safely. We strongly believe that using best-in-class services makes your data safer and more secure.
We leave our infrastructure to the experts
Punchpass is hosted on Amazon Web Services (AWS.) AWS has become the gold standard in cloud infrastructure hosting, allowing Punchpass to scale globally. More information can be found at the AWS Security Center.
Backups are kept for one year
Currently our logs and backups are kept for one year and then deleted automatically.
SSL everywhere
All Punchpass applications and communication use SSL, which creates a secure connection and keeps data safe.
We don't handle or store credit card data
All payment processing is handled by Stripe, a certified Level 1 PCI Service Provider (the most stringent level of certification available). Any credit card data is submitted directly to Stripe via JavaScript over a secure SSL connection. The payment data never touches our servers.
Prompt disclosure of any security issues
We will quickly investigate any reported security issues. If you've discovered a security bug, please send an email to [email protected]. We will try to respond within 24 hours and request that you not publicly disclose the issue until we can address it.
GDPR specific concerns
For specific concerns regarding GDPR visit our Privacy Policy
Specific questions? Please contact us at [email protected] and we'll get right back to you.
