Security

1. Our principles

• We do not need your data to do our job, so we are built not to be able to read it.
• Mask first. Whatever can be a fingerprint or a masked value is never stored in the clear.
• You hold the keys. The ability to open your receipts stays with you.
• Keep less. What we do not collect cannot leak, be lost or be demanded.

2. Sealed on arrival

When a till sends a receipt to Shahidi Box, we find your box using a fingerprint of your phone number, email address or KRA PIN, then encrypt the receipt with your public key before it is stored. Only the matching private key, which stays with you, can open it. What we keep is a sealed envelope. Each receipt also gets its own random key, so one sealed receipt reveals nothing about another.

3. Masked identifiers

• Phone numbers, email addresses and KRA PINs used for matching are turned into keyed one-way fingerprints. A fingerprint can be compared with a detail someone already knows, but cannot be turned back into the original.
• Card numbers are never stored in full. Where a receipt shows a payment, only the masked form printed on the receipt is kept, and it is sealed with the rest.
• Shown masked. Where the app shows an identifier on screen, it shows it masked until you choose to reveal it.

4. Your keys and recovery

• Your keys are created on your device when you open your box. The private key never leaves your control in the clear.
• You set up a recovery key so you can open your box on a new phone.
• If you lose your device and your recovery key, we cannot restore your receipts. That is how we can promise we cannot read them. We will make recovery easy to set up and easy to check.

5. In transit and at rest

• Every connection to Shahidi Box uses TLS, with HTTPS enforced on the website.
• Stored data is encrypted on disk by our cloud provider, on top of the per-user sealing above.
• Requests from a shop’s till are signed, so only that till can post receipts for that shop, and each carries a unique key so a retry never creates a duplicate.
• Every receipt has a SHA-256 fingerprint, so a change to the original can be detected.

6. What we can see, and what we cannot

7. Access by people

• Receipters staff cannot read receipt contents, because they do not have the keys.
• Access to production systems is limited to the few people who need it, uses multi-factor sign-in, and is logged.
• We review those logs, and we remove access when a person’s role changes.
• Our service providers process data for us under contract and see only sealed data.

8. Sharing, export and deletion

• Share one receipt with a link that expires, and take it back at any time. The rest of your box stays sealed.
• Export all your receipts in a standard format.
• Delete a receipt or your whole box. It is removed from our systems within 30 days, including backups.

9. What we ask of you

• Keep your recovery key somewhere safe and private.
• Do not share your sign-in codes with anyone, including anyone who says they are from Shahidi Box. We will never ask for your recovery key or your codes.
• Use a screen lock on your phone, and keep it updated.

10. If something goes wrong

We monitor the service, and have a plan for security incidents. If an incident puts your information at risk, we will tell the Office of the Data Protection Commissioner within 72 hours and tell the people affected promptly, with plain advice on what to do. See our Privacy notice.

11. Report a security issue

If you find a weakness, please tell us at receipters@receipters.com with the subject “Security report”. We ask that you:

• give us a reasonable time to fix it before you share it publicly;
• do not access, change or keep other people’s data, and stop once you have shown the issue; and
• do not disrupt the service or use social engineering against our staff.

If you act in good faith and follow these points, we will not take legal action against you, and we will thank you. We will reply within 3 working days.