How Lotably protects your data

Each operator’s data stays separate

• Every record carries the operator it belongs to, and the data layer scopes every query to that operator automatically. A request without a valid operator context is refused rather than guessed.
• Each operator has its own brand, fines, users, and payout account, so one operator can never see or change another’s data.
• Lotably staff can reach an operator’s workspace only through an audited support mode, and every action taken there is recorded.

Payments run on Stripe

• Drivers enter card details on Stripe’s hosted payment pages. Lotably never sees or stores full card numbers.
• Payments are direct charges on the operator’s own Stripe account. Lotably never holds operator funds.
• Payment notifications from Stripe are verified by signature before Lotably acts on them.

Accounts and access

• Passwords are stored as salted bcrypt hashes, never in plain text.
• Operators give each user only the permissions they need, and a change or revocation takes effect immediately.
• Monthly parkers sign in to their portal with single-use links that expire after 15 minutes, or after 3 days when the link comes in an invite from the operator.
• Password resets and parker portal sign-in requests are rate limited to slow down guessing and abuse.

A record of what happened

• An audit log records setting changes, refunds, tickets marked paid, plan changes, exports, and other significant actions, with who did them and when.
• Exports of operator data are themselves logged, including who exported what and how many rows.
• Signed agreements are stored with a fingerprint of the exact text that was signed, so the record can’t drift from what the customer saw.

Protecting data in transit and at rest

• All traffic to Lotably uses HTTPS.
• Credentials an operator saves for a connected system, such as a pay-station account, are encrypted at rest with AES-256-GCM.
• Lotably’s pages send security headers that stop them from being framed by other sites and keep full page addresses out of referrer headers.
• The Services are hosted in the United States. Our error monitoring has session replay turned off, so it never records anyone’s screen.

Your data, your exit

• Operators can export their tickets, boots, parkers, and payments as CSV or JSON at any time, with no request needed.
• Retention is set out in our Services Agreement: customer data is kept for 7 years after the agreement ends and then deleted, and a customer can direct earlier deletion, which we complete within 90 days (copies in backups are removed on the normal backup cycle).
• The database is backed up with point-in-time recovery.

The documents behind this page

Our commitments are in writing. The Privacy Policy explains what we collect and why, the Software Services Agreement (Canada) sets out data handling, retention, and deletion, and the Acceptable Use Policy covers how operators may use the platform. Running a security review for a campus, hospital, or city? Contact us and we’ll work through your questionnaire with you.