A gift card code is money. Anyone who has the sixteen digits can spend the balance, which makes codes the most valuable thing in any gift card system and the first thing an attacker looks for. So we designed AfroPin on a simple principle: a code should reach the customer, and nobody else.
We don't store codes
AfroPin never stores PIN codes in a form that can be read back. When a PIN is issued, we keep a one-way fingerprint of the code, enough to check a code when it is presented, and a masked version such as 4821-****-****-0917 for receipts and reports. The full code itself is not kept.
That means a leaked database, a curious employee or a compromised admin account can't produce a list of spendable codes, because there isn't one. It also means we can't look up a lost code. Instead, a reseller can reissue the PIN: it keeps its balance, gets a new code, and the old one stops working.
Staff see masks, customers see codes
Counter staff, at both resellers and brands, only ever see codes masked. When a reseller's till sells a card, we email the code and its QR code directly to the customer. When a brand's till takes a part payment on a product that issues a new code, the receipt shows only the new code's mask, and the customer gets the code by email.
Customer email addresses and phone numbers attached to PINs are stored encrypted.
Webhooks, carefully
Resellers that deliver codes through their own systems receive them by webhook. Each webhook is signed so the receiver can check it came from us, and our webhook logs show codes masked. If a delivery fails, we keep the code encrypted for no more than 72 hours so it can be retried or resent, then delete it.
Locking down the account around the codes
- Two-factor authentication is required for the changes that matter: API keys, webhooks, payout details and terminals.
- Signed API requests. Every API call is signed with the partner's secret and time-stamped, so it can't be forged or replayed. Keys can also be restricted to known IP addresses.
- No double redemptions. A retried redemption returns the original receipt instead of charging the PIN again.
- Verified businesses only. Every brand and reseller passes our checks before going live.
No system is perfectly secure, and security is never finished. But by not holding codes at all, we have removed the biggest prize from the table. If you ever think a code has been exposed, our Help Center explains what to do, and our support team is there to help.
