Security at R4ACO
Careful by design.
The information behind an ACO deserves thoughtful protection. Here’s how access, credentials and history are kept in their proper place.
- 01
Credential custody
A separate home for credentials.
Retailer credentials are stored in AWS Secrets Manager, apart from ordinary operational records. Staff can replace them without revealing the stored values.
- 02
Sensitive actions
Your sign-in, with clear limits.
Authorized staff can use a verified R4ACO email credential or linked Discord sign-in. Passwords use a salted memory-hard verifier, recovery links are expiring and one-time, and every download checks current permissions plus an unexpired selection tied to the same user, workspace and login session. Customers cannot access operator credential files.
- 03
Access boundaries
Your workspace stays yours.
Current membership and permissions are checked for protected operations. Another business’s owner does not become an administrator of your workspace.
- 04
Accountability
A history you can follow.
Submission, assignment and export history remain attached to the operation. Important configuration and security actions leave a safe audit record.
- 05
Payment data
Payment data is encrypted for the submitted run.
Cardholder data is sealed with AES-256-GCM under a dedicated AWS KMS key and bound to its tenant and customer. Card numbers and security codes are not displayed back in customer or staff pages; authorized exports decrypt only the data frozen with that profile.
- 06
Honest readiness
Readiness is checked one path at a time.
Bot, retailer and account combinations have separate readiness evidence. R4ACO shows blockers instead of treating one successful import or connection as approval for every workflow. We do not claim PCI, SOC 2 or other compliance certifications.
Become a provider
Run your ACO the swift way.
One workspace from the link in your Discord to the file your bot imports. Free during the open beta (then $20/month or $200/year), with a listing in Discover.