Security

Security and compliance

Last reviewed 12 August 2026

A gift card balance is money you owe your customers. That makes a gift card platform a financial record as much as a marketing tool, and it has to be treated accordingly. This page sets out the controls Wrapped has in place, what each one actually defends against, and how to get compliance documentation for a formal security review.

In 30 seconds

Gift card codes are high-entropy and stored hashed or encrypted, never in plain text. Data is encrypted in transit and at rest. Access is role-based with two-factor authentication, and every issuance, adjustment and redemption is audit-logged. Individual cards can be suspended instantly across all channels. Wrapped does not store raw payment card numbers — payments stay with your POS, your checkout, or Stripe.

Gift card codes and balances

High-entropy codes. Codes are generated randomly with enough entropy that they cannot practically be guessed or enumerated. Sequential or predictable codes are the single most common cause of large-scale gift card loss.
Encrypted at rest, hidden in tooling. Codes are stored hashed or encrypted and are not shown in full in admin screens or exports, so a compromised staff account or a leaked report does not hand over spendable value.
Rate-limited redemption. Redemption and balance-check endpoints are rate limited, which is what defeats automated code-testing against your program.
One canonical balance. Because the balance lives in one place rather than being mirrored per channel, the same value cannot be spent twice by racing two channels against each other.

Account and staff access

Role-based permissions. Issuance, balance adjustment and bulk creation are separate permissions, so a till user does not get the ability to mint value.
Two-factor authentication. Available on accounts and required for elevated actions.
Audit trails. Every issuance, adjustment and redemption records the acting user, the channel and the timestamp.
Per-card suspend. A suspected card can be frozen from the dashboard, taking effect on every connected channel at once.

Platform and data handling

Wrapped applies technical, administrative and physical controls proportionate to the data it holds: encryption in transit and at rest, scoped access controls with two-factor authentication for staff, separated production and testing environments, regular security reviews, vendor due diligence, and defined breach-response procedures. The full statement, including what data is collected and how long it is kept, is in the privacy policy.

No platform is invulnerable, and Wrapped does not claim otherwise. What it does commit to is that the controls above are in place and that incidents are handled under a defined process.

Payment data

Wrapped does not store raw payment card numbers. When a customer buys a gift card, the payment is processed by your connected POS, your eCommerce checkout, or Stripe on the Wrapped storefront. What Wrapped records is the gift card transaction itself — amount, recipient, scheduled delivery, personalised message, redemption history and balance. This materially reduces the scope of any Wrapped-side incident.

Fraud patterns these controls address

Card draining, code harvesting, social engineering, chargeback fraud and internal fraud each exploit a different weakness, and the platform controls that defeat them are different too. The gift card fraud prevention guide works through all five attack patterns and the specific defence for each — worth reading whether or not you use Wrapped.

Running a security review

If your organisation requires compliance documentation, a security questionnaire response, or a data processing agreement, contact support@wrappedgiftcards.com and ask for the current pack. Getting the real, current status directly is more useful than a claim on a marketing page — and it is what your auditors will want anyway.

The Pro plan and above include a separate test-mode API token, so integration work can be validated end to end without touching production data.

Security: frequently asked questions

Is Wrapped PCI DSS or SOC 2 certified?

Wrapped does not publish a certification claim on this page. Enterprise buyers running a security review should request current compliance documentation directly from support@wrappedgiftcards.com — that way you get the actual status and scope rather than a marketing summary. Note that Wrapped does not store raw payment card numbers: card payments are processed by your connected POS, your eCommerce checkout, or Stripe on the Wrapped storefront.

How are gift card codes protected?

Codes are generated with high entropy so they cannot be guessed or enumerated, and stored hashed or encrypted at rest rather than in plain text. They are not displayed in full in admin tools or reports. Redemption endpoints are rate limited, which defeats the code-guessing and BIN-testing attacks that digital gift card programs face.

Who at my business can issue or adjust gift cards?

Only the people you authorise. Issuance, balance adjustment, and bulk creation are gated behind role-based permissions, with two-factor authentication available on accounts and required for elevated actions. Every issuance, adjustment and redemption is written to an audit trail with the acting user and channel, so you can reconstruct exactly what happened.

What happens if we suspect a card has been compromised?

Individual cards can be suspended immediately from the dashboard, which stops redemption on every connected channel at once rather than one POS at a time. The per-card timeline shows redemption history broken down by channel, so you can scope the incident in one session. Speed matters here — most gift card fraud has a short window between code harvest and balance drain.

Where is our data stored, and what happens to it if we leave?

Data handling, storage locations and retention are set out in full in the privacy policy. On cancellation you can export the complete gift card ledger — codes, balances and transaction history — for a 30-day window. Outstanding balances remain redeemable obligations to your customers under applicable consumer protection law.

Does Wrapped have access to our customers’ payment details?

No. Payment processing stays with your existing provider — your POS, your eCommerce checkout, or Stripe on the Wrapped storefront. Wrapped records the gift card transaction (amount, recipient, delivery, redemption history and balance), not the payment instrument used to buy it.