Security and trust
What your security and procurement teams will ask, answered up front.
Encryption
TLS 1.2+ in transit and AES-256 at rest. Bank and biller account numbers are encrypted field by field with keys in a managed KMS.
Tenant isolation
Every record is scoped to a partner, and automated tests check that no request can read another partner's data.
Access control
SSO and multi-factor authentication for our staff and your admins, least-privilege roles, quarterly access reviews.
Audit trail
Every admin action and money movement is logged immutably and can be exported.
Compliance program
SOC 2 Type I audit underway, Type II to follow. Card data stays with our processor; the platform stores no card numbers.
Responsible servicing
Reminders before each payment, clear authorization records, no late fees, and refunds within three business days.
Need our due diligence pack?
Security questionnaire, policies and insurance certificates, shared under NDA.