Security & compliance

Built so your money never touches us.

Novador records sales and issues rewards. It never holds, routes or settles funds.

The money flow

Guest Your terminal your bank NOVADOR Money Sale data No funds are held, routed or settled by Novador

You charge as usual

Guests pay on the venue's own terminal or in cash.

We record, not process

Every sale is attributed to staff, terminal and shift.

Rewards, not money

NOVD loyalty points can only be spent inside the network, never cashed out.

Operational security

Controls on every shift.

Role-based access

Supervisors, bartenders, door staff and promoters work in segmented roles, verified on the server.

PINs never stored in clear

Staff PINs are kept only as one-way hashes.

Signed, single-use codes

Payment codes are signed on the server, expire after 60 seconds and are rejected if reused.

Derived till totals

Reconciliation figures come from the underlying transactions, never typed in by hand.

Data protection (GDPR)

Guest data, handled plainly.

  • The venue owns its data

    Novador acts as a data processor; the venue is the controller.

  • Minimum necessary

    Staff only see what they need to serve a guest.

  • Every lookup is logged

    Who searched for whom, and when.

  • Right to erasure

    Guests can request deletion of their data.

NOVD · loyalty points, no monetary value

NOVD is loyalty, not an investment.

  • Earned only by spending at partner venues.
  • Spendable only inside the network.
  • Never cashed out, never traded, never transferred outside the network.

Designed to fit the EU exemption for loyalty rewards. An independent legal review is planned.

Status

Where we are today

System status
Last updated: September 2026
Live
  • Role-based access with server-side PIN verification Each role sees only its own screens; PINs are checked on the server, never on the device.
  • Signed single-use payment codes Payment codes are signed on the server, expire in 60 s and are rejected if reused.
  • Derived till reconciliation Till totals are calculated from the transactions, never typed in by hand.
Next
  • Independent security audit An external audit of the rewards system, scheduled with our seed round.
  • Independent legal review Lawyers will confirm that NOVD loyalty points fit the EU rules for loyalty rewards, scheduled with our seed round.
  • Direct payment-provider integration Sales recorded straight from the card provider, with no manual step.
  • Offline-first terminal operation Terminals keep recording when the connection drops and sync afterwards. In development.

We publish what is built and what is not.

The life of one sale

One sale, from terminal to audit log.

Novador never stores card numbers, and never receives them.

  1. 1

    Recorded at the terminal

    Stored · Amount, category and time Never stored · The card number
  2. 2

    Attributed to staff, terminal and shift

    Stored · Who sold it, where and in which shift Never stored · Staff PINs in clear
  3. 3

    Written to the server

    Stored · A signed sale record Never stored · Card data of any kind
  4. 4

    Reward issued

    Stored · The NOVD amount on the guest account Never stored · A cash value
  5. 5

    Visible in the dashboard

    Stored · Nothing new: totals are derived from the records Never stored · Figures typed in by hand
  6. 6

    Kept in the audit log

    Stored · Who did what, and when Never stored · Card numbers

What we do not do

  • We do not hold your money.
  • We do not touch card data.
  • We do not sell data to third parties.
  • We do not let guests convert rewards into cash.
  • We do not show staff more than their role needs.
For venue owners

Your data, your rules.

You decide how long records are kept

Set the retention period that fits your venue.

You can export everything

Your sales, staff and guest records, whenever you want them.

You can request deletion at any time

Ask for your venue's data to be removed, and it will be.

Security contact

Found a vulnerability? Write to security@novador.io.

We answer every report.

Be one of our first pilot venues

Request a pilot