Does Mashgin use facial recognition? Does it record shoppers?#
Mashgin itself does not use facial recognition. Its cameras are aimed at the checkout tray to identify items. Mashgin captures multi-angle video of each transaction, which operators use for audits, and shoppers can see that transactions are recorded. Operators that want biometric options can add third-party integrations such as Wicket, Keyo, and IDmission.
How secure is Mashgin, and what security certifications does it have?#
Mashgin is built so that sensitive data never sits where it doesn't belong. Card data is encrypted at the payment terminal and processed entirely by certified third parties, and Mashgin's security controls are independently audited. Mashgin holds SOC 2 Type I and SOC 2 Type II attestations and is GDPR compliant, and its audit reports are available on request.
Payments: Mashgin's payment terminals use point-to-point encryption (P2PE), so card data is encrypted inside the terminal at the moment of tap or swipe and decrypted only by the third-party payment gateway. Mashgin software never sees a full card number, which keeps both Mashgin and its customers out of PCI DSS scope. Liability for card processing rests with PCI-validated gateways and processors, and staff can still retrieve receipts and issue refunds without entering PCI scope.
Network and data: Mashgin kiosks and ordering tablets sit behind a built-in firewall with no exposed inbound ports. All traffic to Mashgin's cloud is tunneled through an encrypted (ChaCha20) VPN, with TLS 1.2 or 1.3 encryption inside it, and data at rest is encrypted with AES-256. Mashgin's cloud environment on AWS is segmented into private and public security groups.