Security at Motive
An overview of the security procedures and infrastructure we use to protect your data and keep Motive running reliably.
Encryption
All data is encrypted in transit using TLS and at rest using AES-256 encryption. We enforce strict HTTPS across all endpoints and our API.
Infrastructure
Hosted on AWS with ISO 27001 and SOC 2 compliant infrastructure. We use managed services with automated failover, backups, and 24/7 monitoring.
Authentication
We use OAuth 2.0 with Google and Apple Sign-In. Passwords are hashed with bcrypt. Sessions are managed using short-lived JWTs.
Development Practices
Our code is reviewed before deployment. We perform static analysis and follow OWASP security guidelines. Engineers receive ongoing security training.
Incident Response
We maintain 24/7 monitoring of our systems. Engineers serve on-call rotations and are trained to respond to security incidents promptly and effectively.
Privacy
We do not sell or share your personal data with third parties for marketing. For full details, see our Privacy Policy.
Payments
We process payments through Stripe, a fully PCI-DSS Level 1 compliant service provider. Motive does not process or store any payment card information — all payment data is handled directly by Stripe.
Infrastructure
Our backend infrastructure is hosted on AWS, which maintains the following compliance certifications:
Data Encryption
All data transmitted between your device and our servers is encrypted using TLS 1.2+. Data at rest is encrypted using AES-256 across our databases and storage. We do not store passwords in plaintext — all credentials are hashed using industry-standard algorithms.
Authentication & Access Control
We use OAuth 2.0 with Google and Apple Sign-In to minimize credential exposure. Sessions are managed using short-lived JSON Web Tokens (JWT). Access to production systems is restricted to authorized personnel with multi-factor authentication required.
Development & Testing
All code changes are peer-reviewed before deployment. We perform static analysis and follow OWASP Top 10 guidelines. Our engineers receive training in secure coding practices and participate in ongoing security reviews. We maintain separate development, staging, and production environments.
Incident Response
We maintain 24/7 automated monitoring and alerting across our infrastructure. Engineers serve rotating on-call shifts and are trained to respond to security and reliability incidents promptly. In the event of a breach, we will notify affected users as required by applicable law, including California law.
Reporting a Vulnerability
If you discover a security vulnerability in Motive, please report it responsibly. We take all reports seriously and will respond as quickly as possible.
Responsible Disclosure
Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to investigate and address them. We appreciate responsible disclosure from the security community.
Security Contact
Email: support@motiverewards.com