How we protect data
Defence in depth.
Encryption everywhere
Data encrypted in transit (TLS) and at rest, with bank details held under AES-256-GCM.
Least-privilege access
Enterprise role-based access control in enforce mode, with MFA for administrators.
Zero-trust admin
Sensitive admin reads re-verify identity at request time — no standing super-access.
Append-only audit log
Every sensitive action is written to an immutable, tamper-evident log.
Card data out of scope
Card numbers never touch our servers — payments run inside our PCI-compliant partner.
Backups & recovery
Regular encrypted backups with tested restore procedures.
Frameworks
Aligned to recognised standards.
Our controls map to the frameworks our customers care about. See the live control list on the compliance page.
SOC 2aligned controls
GDPRUK data protection
PCI DSSpayments in scope of partner
AMLKYC & screening tooling
Reporting
Found something?
We welcome responsible disclosure. If you believe you've found a vulnerability, contact us privately and we'll work with you.