Security that ships in the box.
Card data never touches your servers, every secret is encrypted with per-tenant keys, and the compliance certificates your buyer's security team will ask for are already in the trust center. You inherit the hard parts on day one.
What you inherit by default.
Certifications & assurance
PCI-DSS Level 1 as a service provider, SOC 2 Type II audited annually, ISO 27001 certified. Reports and our PCI AOC are available under NDA, with a bridge letter between audit windows.
Encryption & key management
TLS 1.3 in transit, AES-256 at rest, and per-tenant data keys backed by an HSM. Card data is tokenised at the edge so it never reaches your application or logs.
Data residency & privacy
EU customer data stays in EU regions — Paris and Frankfurt primaries, Stockholm failover. GDPR-clean handling, row-level access logs, and a one-click export for any data subject request.
Access & identity
SAML SSO and SCIM provisioning, role-based access down to the endpoint, and four-eye approval on sensitive actions. Every production access is logged and reviewable.
Reliability
Multi-region active-active infrastructure with a 99.99% uptime target, a public status page, and disaster-recovery drills run quarterly with published RPO and RTO.
Disclosure & testing
Independent penetration tests twice a year, a funded bug-bounty programme, and a security.txt at our root. Confirmed issues get an SLA and a public advisory when resolved.
What we publish, before you ask.
The documents your buyer's security review needs are ready to share, not buried in a procurement queue. Request access and the package lands in your inbox the same working day.
- SOC 2 Type II report — full report under NDA, with a bridge letter.
- PCI AOC — Attestation of Compliance as a Level 1 provider.
- Pen-test summary — latest independent test, executive summary.
- DPA & sub-processors — data processing addendum and the current list.
Need the full report pack?
Tell us what your security review needs and we'll send the documents the same working day. No procurement maze between you and a yes.