MicroBiz Security Policy

Cloud Network

MicroBiz Cloud runs on Amazon Web Services (AWS), a leading US-based cloud provider. Our production systems and customer data are hosted in the United States, and our development environment is kept separate from production.

AWS Data Centers

AWS designs, builds, and operates its own data centers. AWS maintains physical security controls at these facilities, including access controls, surveillance, and audited entry and exit procedures. AWS is regularly audited by independent third parties and maintains industry certifications and attestations, including ISO/IEC 27001, SOC 2, and PCI DSS. You can review them on the AWS compliance programs page.

Data Protection and Backups

Customer data is encrypted at rest and protected in transit using industry-standard encryption. We back up production data every night. We also keep automated database backups for 35 days, which allow us to restore the database to any point within that period. Backups are encrypted and stored in a restricted, non-public location within AWS.

Redundancy and Uptime Planning

MicroBiz Cloud is designed to reduce single points of failure. Production systems are distributed across multiple AWS Availability Zones, which are physically separate facilities, so the service can continue running if a single server or an entire zone fails. Critical components, including our database, fail over automatically. We operate production in a single AWS region and do not currently run a second production environment in another region.

DDoS Protection

MicroBiz uses Cloudflare for DDoS protection. Our public web traffic is routed through Cloudflare’s global network, which detects and blocks attacks at the network edge. We also apply additional traffic controls and monitoring at the server level.

Credit Card Security

Subscription billing. MicroBiz does not process or store customer credit card data. Card handling for subscriptions is done entirely by our third-party subscription management provider, Recurly, Inc. When you sign up for a subscription, you enter your card details into a payment form hosted and maintained by Recurly, and MicroBiz does not have access to the full card data. Our Recurly account is connected to a Stripe gateway for automatic billing. For more information, see Recurly’s security policies.

If you give MicroBiz card information by phone, it is entered into a virtual payment terminal hosted and secured by Stripe, and any forms containing the information are securely destroyed afterward. Card information provided for one-time transactions is not retained.

Payments at checkout in your store. For customers who use integrated payments with MicroBiz POS, we use a semi-integrated model with third-party payment gateways. Card data is encrypted at the payment terminal and sent directly from the terminal to the payment processor through the gateway. Our payment gateway partners are listed on their websites as PCI DSS Level 1 service providers. MicroBiz POS does not receive, process, or store clear (unencrypted) card data. This also applies when a card number is keyed in manually, which is entered on the payment terminal or the gateway’s hosted payment page rather than on the POS screen. MicroBiz POS retains only the transaction result and non-sensitive references, such as the card brand, the last four digits of the payment card and an authorization or token reference.

Customers who do not use integrated payments process cards on a standalone terminal. MicroBiz POS does not exchange any data with a standalone terminal, so card data never passes through our software.

Your PCI responsibilities. Merchants remain responsible for their own PCI DSS compliance, including securing their payment terminals and payment environment and completing any validation their processor requires.

Frequently Asked Questions

Where is my data hosted?

Your MicroBiz Cloud data is hosted on Amazon Web Services (AWS) in the United States.

Is my data encrypted?

Yes. Customer data is encrypted at rest and protected in transit using industry-standard encryption, and our backups are encrypted.

How often is my data backed up?

We back up production data every night. We also keep automated database backups for 35 days, which allow us to restore the database to any point within that period. These backups are for our own disaster recovery. Our Terms of Service also make you responsible for keeping your own copies of your data.

What happens if a server or data center has a problem?

MicroBiz Cloud is built to keep running if a single server or an entire AWS Availability Zone fails, and our database fails over automatically. This design reduces the risk of downtime, but we can’t guarantee uninterrupted service. See our Terms of Service for details.

Does MicroBiz store my customers’ credit card numbers?

No. When customers pay in your store through integrated payments, card data is encrypted at the payment terminal and sent directly to the payment processor through the gateway. MicroBiz POS does not receive, process, or store clear card data. If you use a standalone terminal, our software exchanges no data with it at all.

Does MicroBiz store my own card details for my subscription?

No. Your subscription payment details are handled entirely by our third-party provider, Recurly, and MicroBiz does not have access to the full card number.

Who is responsible for PCI compliance?

Merchants are responsible for their own PCI DSS compliance, including securing their payment terminals and payment environment and completing any validation their processor requires. Our payment gateway partners are listed on their websites as PCI DSS Level 1 service providers. Contact your payment processor for the PCI program that applies to your account.

What protects MicroBiz Cloud from denial-of-service attacks?

We use Cloudflare for DDoS protection, along with additional traffic controls and monitoring on our servers.

What happens to my data if I cancel?

You can export your data during your subscription. After cancellation or termination, we keep your data available for export for 30 days and then delete it, except for data we must keep by law or in routine backups until they expire. Retailers of firearms and other regulated products have record-retention duties, so export your records before canceling. See Section 6.8 of our Terms of Service for details.

How do I report a security concern?

Call our support at 702 749 5353 or email [email protected].

Want to Learn More?

If you have other security questions, call our support at 702 749-5353 or email [email protected].

Need to Report an Incident?

Please call our support at 702 749-5353 or email [email protected].