Security
What we can actually tell you.
We handle children's money and, in schools, their medical information. That deserves a page that is accurate rather than reassuring, so this one says what is true today and names what is not yet in place.
How the system is built
- The money never sits with us
- Nal is a closed-loop ledger, not a bank and not a card scheme. Balances belong to the institution running the system. We move and reconcile them; we do not hold customer funds on our own account.
- Cards carry no balance
- An NFC card is an identifier, not a wallet. Losing one exposes no money — the balance lives server-side and the card is blocked from the admin dashboard, which is why a lost card is an inconvenience rather than a loss.
- Student health data is need-to-know
- Allergies, conditions and emergency contacts are visible to authorised staff at the institution, for the purpose of responding to an emergency. They are not part of the payment record and are not used for anything else.
- Transport is encrypted
- All traffic between apps, devices and our services runs over HTTPS. We do not publish a specific cipher suite here, because that is a property of our hosting provider's current configuration rather than a commitment we control.
What we do not claim
We hold no third-party security certification — not SOC 2, not ISO 27001, not PCI DSS. An earlier version of this page implied otherwise. It was wrong, and we removed it.
We have not commissioned an independent penetration test. We do not operate a formal bug bounty. We do not publish an uptime SLA, because we do not yet measure availability rigorously enough to stand behind a number.
If a certification is a requirement for your institution, tell us which one and we will give you an honest answer about timelines rather than a badge.
Reporting a vulnerability
Email support@nalcard.com with what you found and how to reproduce it. We will acknowledge within five working days. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable window before disclosing it.