Security

Infrastructure

• Hosted with tier-one cloud providers holding SOC 2 Type II and ISO 27001 certifications
• Network segmentation, web application firewall and DDoS protection
• Continuous vulnerability scanning and at least annual third-party penetration testing

Data protection

• All traffic encrypted with TLS 1.2 or higher; HSTS enforced
• Data encrypted at rest with AES-256; keys managed in a hardware-backed key management service
• Card data tokenised; we do not store full primary account numbers or CVV
• Data minimisation and documented retention periods (see our Privacy Policy)

Access control

• Multi-factor authentication for all staff and customer accounts
• Role-based access with least privilege and quarterly access reviews
• Full audit logging of administrative and data-access events

Operational resilience

• Documented incident response plan tested at least annually
• Business continuity and disaster recovery with defined recovery objectives
• Customer and regulator notification of qualifying incidents within applicable statutory deadlines

Responsible disclosure

If you believe you have found a security vulnerability, email security@sendpayfintech.com. Please do not access, modify or exfiltrate data beyond what is required to demonstrate the issue. We will acknowledge reports within 2 business days and will not pursue legal action against good-faith researchers who follow this policy.

Fraud awareness