Information security

Our approach

Qvitti handles tips, guest reviews and basic business data, so keeping it safe is part of the product, not an afterthought. We follow standard industry practice: encrypt data, limit who can see what, and keep as little as we actually need.

Encryption

Traffic between your browser or the Qvitti app and our servers is encrypted in transit (HTTPS/TLS). Data is encrypted at rest on our hosting provider’s infrastructure.

Payments and card data

Qvitti never stores full card numbers. Tips and bill payments are processed by our payment partner, who is responsible for handling and securing card data under their own compliance standards. Qvitti only receives confirmation that a payment succeeded, and the amount.

Access controls

Access to guest and business data inside Qvitti is role-based. Business managers can see their own venue’s staff, tips and reviews — not another business’s. Staff members see their own profile and earnings. Internal access by the Qvitti team is limited to what’s needed to run and support the service.

Hosting and infrastructure

Qvitti runs on reputable third-party cloud infrastructure with regular backups. We keep software and dependencies up to date and review access on an ongoing basis.

Monitoring and incident response

We monitor the service for unusual activity. If a security incident affects your data, we’ll tell you and the relevant authorities where the law requires it, and explain what happened and what we’re doing about it.

Reporting a vulnerability

If you think you’ve found a security issue in Qvitti, please email support@qvitti.com with details. We’ll acknowledge reports and work with you on a fix before any public disclosure.