API keys are hashed
Plain merchant API keys are shown once and stored only as HMAC-SHA256 hashes.
Security
Private media delivery for a public QR experience.
Velop is designed so recipients get a simple scan-to-play flow while merchant data and media remain tenant-scoped.
Signed media URLs
Media files are private by default and served through short-lived signed URLs.
Tenant isolation
Every message, scan event, billing event, and rollup is scoped to merchant ID.
Auto expiry
Messages expire by retention policy and storage lifecycle cleanup removes media.
Firebase rules
Direct writes are denied for message, scan, billing, and analytics collections.
Viewer token gate
Public pages resolve only active, unexpired tokens and return expired states otherwise.