Trust

Trust & Security

This page is maintained by Lynko Ltd to answer common security and privacy questions about the Lynko service. It describes the controls we currently have enabled in the product and how we handle your data. It is not an independent certification.

Shared responsibility

Lynko runs on managed cloud infrastructure. We are responsible for application security, access controls, and how we handle your data. Our hosting providers are responsible for physical security, network, and platform availability. You are responsible for keeping your account credentials safe and for the content you publish on your card.

Authentication & account access

• Email + password sign-in with passwords hashed by our authentication provider — we never see or store your password in clear text.
• Optional Google single sign-on through our managed auth broker.
• Password reset links are scoped to the Lynko domain and expire after use.
• You can delete your account at any time from your settings; this removes your profile and unassigns any cards.

Authorisation & data isolation

• Row-level security policies are enabled on user data so each signed-in user only sees rows they own.
• Staff and admin actions are gated by a dedicated role table — privileges are never read from the browser or from client-supplied tokens.
• Sensitive operations (refunds, role grants, card minting, account deletion) are recorded in an internal audit log.

Card design files & storage

• Customer card-design files live in a private storage bucket. They are never world-readable.
• Draft uploads go through server-side endpoints using a privileged service role, not directly from the browser, so guessing a draft ID does not grant access to the underlying files.
• Time-limited signed URLs are issued only to the owner of the draft or to fulfilment staff who need them to print the card.

Payments

Card payments are processed by Stripe. Full card numbers, CVCs, and expiry dates never reach Lynko's servers. We store only the Stripe customer ID, subscription status, and a summary of each charge for accounting and support.

Hosting & encryption in transit

• The site is served over HTTPS with TLS managed by our hosting provider.
• Database, authentication, storage, and edge functions run on managed cloud services in the UK / EU region.
• Secrets (API keys, service-role tokens) are stored in our hosting provider's secret manager and are only available to server-side code.

Data we collect & retention

See our Privacy Policy for the full breakdown of what we collect, why, and how long we keep it. In short: account and billing data for as long as you have an account, card-tap analytics in aggregate form only (no IP addresses or fingerprints), and leads submitted to a card holder on behalf of that card holder.

Subprocessors

Lynko relies on a small set of subprocessors to run the service: our managed backend (database, auth, storage, edge functions), Stripe for payments, and an email delivery provider for transactional email. A current list is available on request.

Privacy requests

You can request access to, correction of, or deletion of your personal data by emailing privacy@lynko.com. We respond within one month as required by UK GDPR.

Reporting a security issue

If you believe you have found a security vulnerability, please email security@lynko.com with steps to reproduce. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and fix it.

Compliance

Lynko Ltd is a UK company and processes personal data in line with the UK GDPR and the Data Protection Act 2018. We do not currently hold SOC 2, ISO 27001, HIPAA, or PCI DSS certifications. Card payments are handled by Stripe, who is PCI DSS certified.

This page is editable project content maintained by Lynko Ltd and is not independently verified or certified by our hosting platform.