Security & Trust

Beekeeper is built on a simple premise: earn merchant and creator trust by doing less, not more. We collect minimal data, store nothing we don't need, make our practices public, and never monetise your information. This page explains how we protect the platform technically, what we do and don't do with data, and how to report a security issue.

1. Data Minimisation Philosophy

We believe the best way to protect data is to not collect it in the first place. Several architectural choices reflect this:

• Consumers are never identified. When a consumer uses a coupon at checkout, the only identifier the merchant passes to us is their own internal customer reference — which we immediately hash (SHA-256) before storing. Beekeeper cannot reconstruct consumer identities from redemption records.
• IP addresses are never stored in full. For fraud prevention, we truncate IP addresses to the subnet level (the last octet of IPv4 addresses, e.g., 198.51.100.x) before hashing. We store a hash of the network block, not your individual IP.
• No advertising or analytics cookies. We use exactly two cookies: one session cookie required for login, and one translation preference cookie set only if you use the language selector. See our Cookie Policy.
• No tracking scripts. We do not load Google Analytics, Meta Pixel, Hotjar, Mixpanel, or any behavioural tracking tools.
• No data resale. We do not sell, rent, licence, or otherwise transfer your personal data to third parties for commercial purposes. Ever.
• No shadow profiling. We do not build profiles of users beyond what is necessary to operate the service.

2. Encryption Standards

In Transit

All connections to beekeeper.bz and api.beekeeper.bz use HTTPS with TLS 1.2 or 1.3. HTTP connections are automatically redirected to HTTPS. TLS certificates are issued by Let's Encrypt and auto-renewed via Caddy.

API session cookies are set with Secure, HttpOnly, and SameSite=Lax — they cannot be intercepted over HTTP or accessed by JavaScript.

Password Storage

Passwords are hashed using bcrypt with a cost factor of 12 before storage. We never store plaintext passwords, and our engineers cannot read your password. If you forget your password, we cannot tell you what it was — we can only help you reset it.

Token and Key Storage

Coupon tokens, API keys, and session tokens are stored only as cryptographic hashes (SHA-256 or bcrypt). The plaintext value is shown to you once and not retained.

Payment Data

Card details are handled entirely by Stripe (PCI DSS Level 1 certified). Beekeeper never sees, processes, or stores card numbers, CVVs, or full card data of any kind. We receive only metadata: card brand, last four digits, and expiry.

3. Infrastructure Overview

The Beekeeper platform runs on dedicated infrastructure hosted within the EU/EEA. We use Docker containers with hardened configurations:

• Container filesystems are read-only. Application processes cannot write to disk outside of designated temporary directories.
• The database (PostgreSQL) and session store (Redis) are not publicly accessible — they are internal to the Docker network only.
• API and frontend services run as non-root users inside containers.
• All infrastructure access requires authentication. Database and cache credentials are stored as environment secrets, not in source code.
• HTTP Security Headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are all set.

4. Anti-Scraping and Fraud Prevention

Beekeeper exists in part because coupon codes are routinely scraped and mass-distributed, causing merchants financial harm. Our platform was designed specifically to address this:

• Tokenised coupons: Each coupon token is unique, single-use, and time-limited (default 60 minutes). Bulk issuance and reuse are structurally impossible.
• Request pattern detection: Our system detects burst requests (>50 in 60 seconds) and sequential patterns at the network level. Suspected automated requestors are served non-functional test coupons and/or temporarily blocked from token issuance.
• Privacy-preserving fraud detection: All fraud detection operates at the subnet level using hashed, truncated IP addresses. We do not build individual profiles of consumers and do not link fraud signals to user accounts.
• Rate limiting: All token endpoints enforce per-IP rate limits with Retry-After headers.

If you believe your IP or network has been incorrectly blocked, contact security@beekeeper.bz.

5. Zero Dark Pattern Commitment

We commit to never using manipulative design practices:

• No pre-ticked consent boxes
• No hidden fees (all charges are disclosed before billing; see Transparency)
• No forced continuity (cancel your account at any time — no waiting periods, no retention tactics)
• No confusing double-negatives in consent language
• No roach-motel design (it is as easy to leave as to join)
• No deceptive discount presentation
• No countdown timers on non-time-limited offers

6. Algorithm and Automation Transparency

Beekeeper uses automated systems for fraud prevention and rate limiting. These systems do not use machine learning or AI. They are rule-based:

• Rate limiting: If you send more than the allowed number of requests in a time window, you receive an HTTP 429 response with a Retry-After header. This is applied equally to all requestors.
• Fraud scoring: Request timing and frequency patterns are scored against fixed thresholds. High scores may result in temporary service-access restrictions (coupon issuance only). No account actions are taken automatically.
• Counter-fraud tokens: Some requests may receive non-functional test coupons. This affects only suspected automated scrapers and has no financial consequence to legitimate users.

No automated system makes decisions with legal effects about you. Account suspension always requires human review by a Beekeeper administrator. If you believe an automated decision was made incorrectly, contact us and we will review it.

7. Responsible Disclosure

If you discover a security vulnerability in Beekeeper, please tell us privately before making it public. We are committed to working with good-faith security researchers.

In Scope

• Authentication and session management flaws
• Authorisation failures (accessing another user's data)
• Injection vulnerabilities (SQL, command, template)
• XSS, CSRF, and similar client-side vulnerabilities
• Sensitive data exposure
• Logic flaws in coupon/redemption flow

Out of Scope

• Stripe infrastructure (report to Stripe directly)
• Denial of Service attacks — please do not attempt these
• Social engineering
• Automated scanning that would affect platform availability

Security Acknowledgements

No vulnerabilities have been reported to date. We will publicly acknowledge researchers here when vulnerabilities are disclosed and fixed.

8. Your Privacy Rights

As a registered user, you can exercise all GDPR rights directly from Settings → Privacy & Data:

• Download your data — a complete JSON export of everything we hold about you (Art. 15 & 20)
• Delete your account — immediate anonymisation of your profile (Art. 17)
• Restrict or object to processing — stop certain processing while keeping your account (Arts. 18 & 21)
• Marketing preferences — opt in or out at any time

For any privacy request, contact: privacy@beekeeper.bz. We respond within 30 days.

You may also lodge a complaint with Datatilsynet (Norway's data protection authority): datatilsynet.no.

9. Transparency Reports

We publish an annual Transparency Report covering: data subject requests received and fulfilled, security incidents, government data requests (if any), policy changes, and processor changes.

The first report will cover calendar year 2026 and will be published by 31 March 2027.

10. Contact

• Data Controller: Risan Solutions (Org.nr 937 137 273)
• Address: Valenvegen 49, 3802 Bø i Telemark, Norway
• Privacy: privacy@beekeeper.bz
• Security: security@beekeeper.bz