Security Overview
Last updated: 5 November 2026
Version: 2.0
1. Scope
This Security Overview explains the high-level security approach for BOXXED and related services operated by Mrs Samantha Allonby trading as Boxed Events. It is intended to give customers and authorised users a practical summary, not a detailed security manual.
2. Shared Security Model
Security is shared between us, NibbleKit, hosting and infrastructure providers, payment providers, email and messaging providers, app stores, staff users and customers. NibbleKit may provide platform controls and integrations, but we remain responsible for configuring our business operations, staff access, customer communications and published policies accurately.
3. Security Controls
Depending on configuration, the Services may use authentication controls, password reset and email verification flows, HTTPS/TLS, Firebase or Google Cloud security controls, Firestore and Storage rules, role-based access, logging, backup processes, payment-provider tokenisation, app-store controls, abuse monitoring and administrative restrictions.
Our websites and app services use encrypted HTTPS connections. Staff access is limited by role, and we use payment-provider controls so staff do not need access to full card numbers. We review access and work with providers to investigate problems and maintain suitable safeguards.
4. Payment Security
Card and wallet payments are normally processed by a payment provider such as Stripe. We do not receive or store full card numbers through ordinary app checkout. Payment providers may process transaction, device, fraud and compliance information under their own terms and legal obligations.
5. Your Security Responsibilities
You should keep your device, email account, password, verification links, reset links, collection codes and payment methods secure. Do not share account access, use another person's account without permission, reuse compromised passwords, or ignore suspicious order, login or payment activity.
6. Staff and Admin Responsibilities
Authorised staff users must use only their own credentials, keep access limited to legitimate business needs, avoid sharing customer data unnecessarily, report suspected incidents promptly, and follow any training, access, device, data-protection and food-safety procedures that apply to their role.
7. Security Incidents
If we become aware of a security incident, we will assess the facts, take proportionate containment and remediation steps, involve NibbleKit or other providers where needed, and make any legally required notifications to affected individuals, regulators, payment providers or law enforcement.
8. No Absolute Guarantee
No online service can be guaranteed to be completely secure or continuously available. We work to use reasonable controls appropriate to the nature of the Services, but customers and staff should also take sensible precautions and report concerns promptly.
9. Security Contact
Security concerns should be sent to support@boxxedfood.com. Please do not include unnecessary personal data, payment details or sensitive health information in an initial security report.
You may also want to read:
Tell us promptly if you notice an unfamiliar sign-in, order or payment, or if a device or collection code is lost. For a suspected vulnerability, share the affected service, time and a short description without accessing anyone else’s information. See our Acceptable Use Policy for the limits on testing.