Last Updated: January 15, 2025
At SavevyCoupons, security and trust are foundational to everything we build. Our platform handles sensitive coupon data, loyalty balances, and customer information for over 1,200 retail brands. We treat this responsibility with the seriousness it demands — investing in robust infrastructure, rigorous access controls, and transparent operational practices.
This Trust & Security Center provides an in-depth look at how we protect your data, authenticate our communications, respond to incidents, and comply with privacy regulations.
All data in transit is encrypted using TLS 1.3. Data at rest — including database records, file uploads, and backups — is encrypted with AES-256. Encryption keys are managed through AWS Key Management Service with automatic rotation.
Every outgoing email is fully authenticated with SPF, DKIM (2048-bit key), and DMARC (p=reject). Aggregate DMARC reports are monitored daily. Our dedicated sending IP maintains a strong sender reputation across all major ISPs.
Hosted on AWS us-west-2 (Oregon) with multi-Availability Zone redundancy. Auto-scaling compute ensures consistent performance. Managed PostgreSQL with automated backups, point-in-time recovery, and 30-day retention.
24/7 automated monitoring via CloudWatch and PagerDuty. We track email bounce rates, complaint signals, system resource utilization, and application errors in real time. On-call engineers respond within 15 minutes.
Our primary infrastructure runs on Amazon Web Services (AWS) in the us-west-2 (Oregon) region. We use multi-AZ deployment for high availability:
Every end-customer email address undergoes verification during loyalty program enrollment. Unverified addresses never receive transactional messages. Merchants cannot manually add email addresses without the end-customer completing a confirmation step.
We maintain a centralized, cross-tenant suppression list. Email addresses are added to the suppression list upon:
Suppressed addresses are never re-activated unless the recipient explicitly re-enrolls and completes email verification.
We subscribe to feedback loops from all major ISPs including Yahoo/AOL, Outlook/Hotmail, and other participating providers. Complaint signals are processed within minutes and trigger automatic suppression and merchant notification.
Each tenant account has a configurable daily sending quota. If a merchant attempts to send beyond their allocated limit, sending is paused. Volume anomalies (e.g., an account suddenly sending 5× its normal daily volume) trigger automatic suspension and manual review by our operations team.
Only authorized roles (Account Owner, Admin) can modify email templates, notification rules, or sending configurations. API keys with sending permissions require explicit approval from the Account Owner. Changes to critical sending parameters require a secondary approval step.
Modifications to email templates (content, subject lines, sender name) are logged with the user, timestamp, and diff of changes. For enterprise-tier accounts, template changes require approval from a second authorized user before taking effect.
If you receive an unwanted or suspicious email claiming to originate from SavevyCoupons, please report it to abuse@savevycoupons.com. We investigate all reports within 2 business days and take corrective action as described in our Acceptable Use Policy.
Our incident response process follows five phases:
For incidents involving personal data breaches, we notify affected data controllers within 72 hours as required by GDPR Article 33. Affected individuals are notified without undue delay when the breach poses a high risk to their rights and freedoms.
All logs are stored in immutable, append-only storage. Access to logs is restricted to authorized operations and security personnel via RBAC.
SavevyCoupons is committed to compliance with the following regulatory frameworks:
We welcome security researchers who help us keep our platform safe. If you discover a potential security vulnerability in SavevyCoupons, please report it to us responsibly:
Please refrain from publicly disclosing vulnerabilities until we have had a reasonable opportunity to investigate and remediate. Do not access, modify, or delete data belonging to other users during your testing.
For security-related questions, trust inquiries, or compliance documentation requests: