Kivvo Security & Fraud Policy

Plain-English summary

We take security seriously. Your money, your data, and your account are protected by encryption, access controls, and fraud monitoring.

We don't hold your money. Stripe does — a globally regulated payment processor.

Kivvo does not read bank balances or transaction history. Stripe will handle BECS Direct Debit authorization when the setup is available.

We monitor for fraud. Suspicious activity is flagged automatically.

You have a role too. Keep your password secure, watch for phishing, and tell us if something looks wrong.

If you see something suspicious, report it immediately at Support.

We will never ask for your password or verification code by email.

The full policy follows. The summary is for convenience — the full policy is what applies.

1. Purpose of this policy

This Security & Fraud Policy explains:

How Kivvo protects your account, data, and money

What we do to detect and prevent fraud

What you can do to stay safe

How to report a security issue or suspected fraud

What we do if something goes wrong

It applies to everyone who uses Kivvo. It should be read alongside our Terms of Service, Privacy Policy, and Acceptable Use Policy.

2. Our security commitments

2.1 Encryption

In transit: All traffic between your device and Kivvo uses HTTPS/TLS. Your data is encrypted while moving between your device, our servers, and third-party services.

At rest: Data stored by Stripe and Supabase is encrypted at rest using industry-standard encryption.

2.2 Password security

We never store your password in plain text. All passwords are hashed using strong, industry-standard algorithms (via Supabase Auth). Even we can't see your password.

2.3 Access controls

Only a small number of authorised Kivvo personnel can access production systems. Access is:

Role-based (only what's needed for the role)

Logged

Revocable at any time

Protected by multi-factor authentication (MFA)

2.4 Audit logging

Sensitive actions in Kivvo — such as account changes, payment events, and admin actions — are logged. Logs are retained for security and compliance purposes.

2.5 Rate limiting and abuse prevention

Kivvo's APIs are protected by rate limiting to prevent brute-force attacks, scraping, and abuse.

2.6 Vendor security

We only work with established, security-conscious providers. Our current processors are:

Each of these providers has its own security program and undergoes regular audits.

3. How we protect your money

3.1 Kivvo does not hold your money

Your money is held by Stripe, not Kivvo. Stripe is a globally regulated payment processor. When you contribute to Kivvo:

The funds leave your payment method and are held by Stripe

The balance is associated with your Kivvo account

Kivvo does not take custody of your funds

You can withdraw at any time through the app

This separation is deliberate. It means even if Kivvo's systems were ever compromised, your money is protected by Stripe's own security infrastructure.

3.2 Card data is never stored by Kivvo

Kivvo does not see or store your full card number, CVC, or expiry date. All card data is handled directly by Stripe.

3.3 Bank credentials are never stored by Kivvo

Stripe BECS Direct Debit authorization will take place in Stripe's secure flow when available. Kivvo does not receive bank credentials or read balances.

3.4 Withdrawals go back to the source

Withdrawals return to your original payment method. This prevents funds from being sent to a different account than the one they came from — a common fraud pattern.

4. How we protect your data

4.1 Data minimisation

We collect only what we need to run Kivvo. See our Privacy Policy (Section 3) for a full list of what we collect.

4.2 Data isolation

Your goals, contributions, and account information are isolated from other users. Users cannot access each other's data — access controls are enforced at the database and API level.

4.3 Secure deletion

When you delete your account, we delete your personal data in accordance with our Privacy Policy (Section 8). Some records (payment history, tax records, cashback records) are retained for legal reasons, but are still protected by the same security measures.

4.4 Backups

Data is backed up regularly to prevent loss. Backups are encrypted and stored separately from production systems.

5. How we detect and prevent fraud

5.1 Automated fraud monitoring

We use automated systems to detect suspicious activity, including:

Unusual login patterns (new device, new location, rapid attempts)

Unusual payment patterns (unexpected amounts, rapid succession, card-testing)

Unusual contribution patterns (unusual amounts, mismatch with user's normal behaviour)

Attempts to abuse cashback, streaks, or promotions

Duplicate accounts or linked accounts

5.2 Stripe's fraud tools

Stripe provides additional fraud detection for all payments, including:

Machine learning fraud scoring

Card testing prevention

Radar rules (custom fraud prevention rules)

3D Secure authentication where required

5.3 Manual review

Where automated systems flag something suspicious, our team may manually review the activity.

5.4 Account verification

For certain actions — such as large contributions, unusual withdrawal patterns, or account recovery — we may ask you to verify your identity.

5.5 Cooperation with authorities

Where required by law, or where we have a reasonable belief that fraud or illegal activity has occurred, we may report the matter to:

New Zealand Police

The Financial Markets Authority (FMA)

The Department of Internal Affairs (DIA)

Any other regulator or authority with jurisdiction

6. How you can stay safe

6.1 Protect your Kivvo account

Use a strong, unique password. Don't reuse your Kivvo password anywhere else.

Use a password manager. Tools like 1Password, Bitwarden, or your browser's built-in manager make this easy.

Don't share your account. Your Kivvo account is for you only.

Log out on shared devices. If you use Kivvo on a public or shared computer, log out when you're done.

Enable two-factor authentication if and when we offer it (coming soon).

6.2 Watch for phishing

Phishing is the most common way accounts are compromised. Here's how to spot it:

Kivvo will never:

Ask for your password by email, text, or phone

Ask for your verification code by email, text, or phone

Ask for your full card number

Ask for your bank credentials

Ask you to click a link to "verify" or "unlock" your account

Ask you to send money or crypto to anyone

Threaten to close your account unless you act immediately

If you get a message like this, it's not from us. Report it at Support.

6.3 Check URLs before clicking

Kivvo's real website is at kivvo.co.nz

Always check the domain before entering your login details

Look for the padlock icon in your browser

Fake sites often use lookalike domains (e.g. kivvo-app.com, kivvo-nz.net)

6.4 Watch your contributions and withdrawals

Review your contribution history regularly

Check your bank statements for unfamiliar charges

If you see something you don't recognise, report it immediately

6.5 Keep your device secure

Install operating system and app updates promptly

Use a screen lock on your phone

Avoid using Kivvo on public Wi-Fi networks without a VPN

Don't install Kivvo from anywhere other than the official app stores

6.6 Keep your email secure

Your Kivvo account is protected by your email. If someone gets into your email, they can potentially reset your Kivvo password.

Use a strong password on your email

Enable 2FA on your email

Don't use the same password for email and Kivvo

7. Reporting security concerns

7.1 If your account is compromised

If you believe your Kivvo account has been accessed without your permission:

Change your password immediately (via the app or Support)

Contact us at Support with details

Check your contribution history for unfamiliar activity

Contact your bank if you see unfamiliar charges on your card

We will investigate and take appropriate action.

7.2 If you suspect fraud

If you believe someone is committing fraud through Kivvo — or attempting to defraud you by pretending to be Kivvo:

Report it at Support

Include as much detail as you can (screenshots, email addresses, URLs)

Don't engage further with the suspected fraudster

We take all reports seriously.

7.3 If you find a security vulnerability

If you're a security researcher and you believe you've found a vulnerability in Kivvo:

Report it responsibly at Support

Include steps to reproduce, if possible

Give us reasonable time to fix it before public disclosure

Don't access, modify, or delete other users' data while testing

Don't disrupt Kivvo's service

We appreciate good-faith security research. We may recognise responsible disclosures.

7.4 What happens after you report

When you report a security issue:

We acknowledge receipt within 2 business days

We investigate and may ask for more information

We take action (lock account, reverse fraudulent transactions, etc.)

We update you on the outcome

8. What happens if there's a data breach

If we become aware of a data breach that could affect your rights:

We investigate immediately and contain the breach

We notify you if there's a risk of harm to you

We notify the Office of the Privacy Commissioner as required under the New Zealand Privacy Act 2020

We take steps to prevent it happening again

We publish information where required or appropriate

We do not hide breaches. If something happens, we'll tell you.

9. Account recovery

If you lose access to your Kivvo account, we offer account recovery through:

Password reset via email

Verification via support ticket if email recovery isn't possible

Where we believe an account may be compromised, we may ask for additional verification before restoring access.

10. If we suspect fraud on your account

If we detect activity we believe is fraudulent:

We may temporarily pause your account to protect your funds and our systems

We may contact you to verify the activity

We may reverse transactions where legally entitled

We may report the matter to the relevant authorities

If we pause your account, we will tell you why (unless legally prevented from doing so). You can appeal the decision via Support.

11. Third-party security

Some of the services you interact with through Kivvo are operated by third parties with their own security programs:

We recommend reviewing their security documentation if you have concerns.

12. Changes to this policy

We may update this Security & Fraud Policy from time to time. When we do:

The "Last updated" date at the top will change

Material changes will be communicated by email and in-app

Continued use of Kivvo after changes take effect means you accept the updated policy

13. Contact

Security concerns, fraud reports, or vulnerability disclosures:

Support: Support

A real person reads every ticket.

END OF SECURITY & FRAUD POLICY

Version 1.0 · Last updated 5 October 2026 · Effective 5 October 2026