LoyalVerse
Loyalty, gift cards and customer engagement for retail groups - points, tiers, vouchers and gift cards on separate immutable ledgers, with tenant isolation and consent-gated communications engineered in, live across five surfaces: admin, wallet, POS, clienteling and Go.
Inside the product
See it, not slideware
Real captures, never staged for this site - each caption says exactly what you are looking at.
Overview
LoyalVerse is a live, multi-tenant retail loyalty, gift card and customer engagement platform. It is built for retail groups that run multiple brands across countries and currencies: loyalty programmes with points, tiers, vouchers and stamp cards; gift cards on their own ledger; and customer communications that are consent-gated by design. Every value movement lives on an append-only ledger, every tenant is isolated at the database layer, and every operation is idempotent end to end - the accounting-grade discipline loyalty liabilities deserve. Twenty-six backend modules are live - loyalty, gift cards, commerce, inventory, store operations, risk, CDP, engagement and more - across five surfaces on one spine: an admin cockpit for the programme team, a member wallet, a billing-first point of sale, a clienteling surface for store associates, and LoyalVerse Go for shopper self-checkout. Every surface is on this site in the UI tour, captured from the working platform.
The business problem
Loyalty points and gift cards are financial liabilities, but most programmes run on tooling that treats them as marketing gimmicks: balances that drift, adjustments nobody can trace, brands sharing a database with no real isolation, and customer messaging sent without provable consent. Multi-brand groups feel it worst - every brand, country and currency multiplies the reconciliation problem. The programme needs ledger discipline, not another campaign tool.
Who it is for
- Multi-brand retail groups
- Loyalty and CRM programme owners
- Retail finance teams who answer for the liability
- Store and e-commerce operations teams
- Store associates and cashiers, on their own surfaces
Capabilities
Key features
Loyalty programmes - points, tiers, vouchers and stamp cards with versioned earn rules, so every ledger entry cites the rule that priced it
Gift cards on a separate immutable ledger - sold, gifted, redeemed in mixed tender and reconciled with a full trail; codes stored only as keyed hashes
Returns done right - refunds route back to gift cards first, earned points reverse proportionally, and over-returns are capped per line even under racing tills
End-to-end idempotency - a till that retries can never double-credit or double-charge, enforced at the endpoint and inside the ledger transaction
Strict tenant isolation - row-level security at the database layer; a foreign tenant header is ignored, the signed-in claim wins
Consent-gated communications - no message without a provable opt-in, across every channel through a provider-adapter model
Five surfaces on one spine - admin cockpit, member wallet, billing-first POS, a dedicated clienteling portal for associates, and LoyalVerse Go self-checkout
Customer 360 and CDP - profile, consents, balances, ledger and gift cards on one record, with audiences, journeys and KPI reports for the marketing team
Commerce and operations built in - products, orders, inventory, purchasing and transfers, merchandising, store tasks and workforce on the same spine
Approval matrix with four-eyes control - large gift-card issues, goodwill points and voucher batches route through role-based thresholds; below threshold, the till never slows down
Ask Verse - AI answers grounded only in the tenant's live aggregates, never per-customer PII, with 'what the model saw' visible on every answer
Multi-brand, multi-country, multi-currency by design - minor units everywhere, three-decimal currencies (KWD, BHD, OMR) native, sales never mixed across currencies
Benefits
- Loyalty and gift-card liabilities you can reconcile to the fils - the ledger is the source of truth and balances are always derived, never edited
- One platform across brands and countries instead of one tool per brand
- Customer trust engineered in: isolation, consent and auditability are architecture, not settings
- Finance and marketing working from the same immutable numbers
- The proof is on this site: a UI tour across all five surfaces, captured from the working platform with a three-million-member seeded tenant
Integrations
- REST APIs described by OpenAPI, with generated clients
- Webhooks via a transactional outbox - events leave exactly once
- Provider-adapter communications - Telegram live in the demo; email, SMS and WhatsApp through the same seam
- Enterprise OIDC single sign-on (Keycloak today, Microsoft Entra External ID ready)
- Built-in POS, plus an integration surface for existing tills and e-commerce
Deployment options
- Managed cloud (SaaS) - hosted and operated by PASDACS
- Dedicated environment for larger groups
Security
Security-first and proven before publish: tenant isolation enforced at the database layer with PostgreSQL row-level security - a foreign tenant header is ignored, the authenticated claim wins - verified by a role-and-permission QA matrix of 44 probes across seven principals, all passing. Enterprise OIDC authentication, append-only ledgers for every value movement with a hash-chained audit log, gift-card codes stored only as keyed hashes, consent records for every communication, DSAR tooling built in, and full idempotency so failures and retries never corrupt balances. The full automated suite - 384 integration, 67 unit and 24 architecture tests - runs green, and an all-tenant money-math sweep found zero drifted balances across 50,084 accounts.
How it compares
Others vs us, feature by feature
"Others" below means typical loyalty and engagement tooling - campaign platforms with a points feature - described fairly. Every "we" claim is live, tested behaviour: 384 integration, 67 unit and 24 architecture tests run green, and the QA sweep found zero drifted balances across 50,084 accounts.
| Feature | Others - typical tools | We - LoyalVerse |
|---|---|---|
| Value movements | Balances edited in place; adjustments overwrite history and nobody can say why a number changed. | Append-only ledgers for points AND gift cards - balances are always derived, never edited, and every KPI tile is a ledger sum. |
| Multi-tenant isolation | Brands share one database, separated by WHERE clauses and discipline. | PostgreSQL row-level security forced on every tenant table; a foreign tenant header is ignored, and a leak-test suite auto-covers every new table. |
| Retries & double-charging | A till that times out and retries can double-credit points or double-charge a card. | End-to-end idempotency, enforced at the endpoint and again inside the ledger transaction - proven under concurrent duplicates. |
| Customer messaging | Campaigns send first and clean the list when complaints arrive. | A fail-closed consent gate on every channel: no provable opt-in, no message - verified across telegram, email, SMS and WhatsApp fan-outs. |
| Gift-card codes | Card codes sit in the database in plain text, one export from disaster. | Codes are shown once and stored only as keyed HMAC hashes with key versioning - PCI-style handling for loyalty credentials. |
| Earn rules & promotions | Rules edited in place; last quarter's earn maths is unrecoverable. | Versioned rules with deterministic selection - every ledger entry cites the rule version that priced it, and overlaps can never double-earn. |
| Multi-currency | Floating-point amounts, one base currency, FX-converted totals that satisfy nobody. | Minor units everywhere, three-decimal currencies native, country-first reporting - currencies are never mixed in a single figure. |
| High-value adjustments | A goodwill credit or a 10,000-card batch is one admin click. | A threshold-based approval matrix with four-eyes at every step; the final signature and the effect commit in one transaction. |
| AI features | An AI badge on the pricing page; when the model is down, answers get invented. | Ask Verse is grounded in tenant aggregates only (never per-customer PII), shows exactly what the model saw, and returns an honest 503 when the model is offline. |
| Integrations & events | Fire-and-forget webhooks that silently drop events during incidents. | A transactional outbox: events are written with the change, delivered with retries and dead-lettering, deduplicated to exactly-once effect. |
Value movements
Others: Balances edited in place; adjustments overwrite history and nobody can say why a number changed.
We: Append-only ledgers for points AND gift cards - balances are always derived, never edited, and every KPI tile is a ledger sum.
Multi-tenant isolation
Others: Brands share one database, separated by WHERE clauses and discipline.
We: PostgreSQL row-level security forced on every tenant table; a foreign tenant header is ignored, and a leak-test suite auto-covers every new table.
Retries & double-charging
Others: A till that times out and retries can double-credit points or double-charge a card.
We: End-to-end idempotency, enforced at the endpoint and again inside the ledger transaction - proven under concurrent duplicates.
Customer messaging
Others: Campaigns send first and clean the list when complaints arrive.
We: A fail-closed consent gate on every channel: no provable opt-in, no message - verified across telegram, email, SMS and WhatsApp fan-outs.
Gift-card codes
Others: Card codes sit in the database in plain text, one export from disaster.
We: Codes are shown once and stored only as keyed HMAC hashes with key versioning - PCI-style handling for loyalty credentials.
Earn rules & promotions
Others: Rules edited in place; last quarter's earn maths is unrecoverable.
We: Versioned rules with deterministic selection - every ledger entry cites the rule version that priced it, and overlaps can never double-earn.
Multi-currency
Others: Floating-point amounts, one base currency, FX-converted totals that satisfy nobody.
We: Minor units everywhere, three-decimal currencies native, country-first reporting - currencies are never mixed in a single figure.
High-value adjustments
Others: A goodwill credit or a 10,000-card batch is one admin click.
We: A threshold-based approval matrix with four-eyes at every step; the final signature and the effect commit in one transaction.
AI features
Others: An AI badge on the pricing page; when the model is down, answers get invented.
We: Ask Verse is grounded in tenant aggregates only (never per-customer PII), shows exactly what the model saw, and returns an honest 503 when the model is offline.
Integrations & events
Others: Fire-and-forget webhooks that silently drop events during incidents.
We: A transactional outbox: events are written with the change, delivered with retries and dead-lettering, deduplicated to exactly-once effect.
Getting started
Implementation & pricing
Implementation timeline
Onboarding is guided: your brands, stores, currencies and earn rules are configured with you - everything in the admin cockpit is configuration, not code. Pilot programmes are scoped in weeks, not months.
Pricing
Offered as a managed subscription (SaaS). LoyalVerse is live as a demonstration platform while onboarding opens to pilot retail groups - talk to us for pilot terms. No public price list yet; we would rather show you the working product first.
FAQ
Frequently asked questions
See it working against your own use cases
Talk to our team about your processes and we will show you how the platform fits.