Trust and security

Passkeys and 2-step verification for everyone; businesses can require them. Breached-password checks, rate limits, bot protection and device recognition on every sign-in. Re-authentication before sensitive changes such as payout accounts and ownership transfers.

Encryption in transit (TLS 1.2+) and at rest (AES-256). Data is stored in the UK and the US. Staff access to production is limited to the people who need it, protected by strong sign-in and logged.

Nightly backups kept for 30 days, restore tests every quarter, and a written incident response plan. Personal data breaches are reported to the ICO within 72 hours where required, and to affected businesses within 48 hours.

We are working towards ISO/IEC 27001 and SOC 2 Type II. Until then, a security questionnaire and our latest penetration test summary are available on request.

Please tell us at [email protected] before telling anyone else. See responsible disclosure.