Platform Security Architecture & PDPA Alignment

Every merchant store on PesanLagi operates inside a logically segmented partition. All customer rosters, stamp balances, cashier queues, and campaign configurations are strictly bound to unique Tenant UUID identifiers.

Backend microservices enforce tenant boundary constraints on every SQL transaction and in-memory cache lookup, preventing cross-tenant data exposure.

Data in Transit: All incoming and outgoing network traffic uses modern TLS 1.3 protocol over HTTPS with HSTS enforcement.

Data at Rest: Persistent database clusters and daily cold snapshots are secured with hardware-accelerated AES-256 block ciphers.

Credential Protection: Passwords and sensitive tokens are protected using BCrypt adaptive salted hashing (work factor 12).

Countertop QR loyalty systems require robust protection against illegitimate stamp claims:

• Live Cashier Queue: Customer scans generate a real-time PENDING claim that must be physically confirmed by the cashier on duty.

• Web Audio Verification Chimes: Distinct audio cues sound instantly when a stamp is validated, eliminating ambiguous screen claims at busy checkout counters.

• Rate Limiting & Cooldown Windows: Automated velocity thresholds prevent repetitive scans from the same phone number within short intervals.

PesanLagi is architected around strict adherence to the seven core data protection principles of Act 709:

1. General Principle: Data is gathered only for authentic loyalty tracking consented to by users.

2. Notice and Choice Principle: Clear notice provided before phone numbers are submitted at scan time.

3. Disclosure Principle: Zero resale of consumer data to third-party ad networks.

4. Security Principle: State-of-the-art encryption, tenant isolation, and strict access control lists.

5. Retention Principle: Data kept only as long as necessary for loyalty lifecycle management.

6. Data Integrity Principle: Accurate transaction logging and real-time reconciliation.

7. Access Principle: Transparent tools allowing users to review and request erasure of their records.

PesanLagi services are packaged in lightweight Alpine Docker containers running under dedicated non-root service accounts, reducing system attack surface.

Production databases undergo automated daily snapshots with regular restoration drills to ensure rapid disaster recovery and business continuity.