TRUST CENTER

Bank-grade by default.
Audited continuously.

Rigid moves cardholder money and cardholder data. Both are protected by controls that auditors test, external teams attack, and this page publishes.

PCI DSS

Level 1 Service Provider

SOC 2

Type II · annual

ISO 27001

Certified

GDPR

DPA available

DORA

EU operational resilience

99.999%

Uptime SLA · every customer

DATA

AES-256 at rest, TLS in flight, PANs tokenized with keys held in payment HSMs. Card data never touches your systems unless you ask it to.

RESIDENCY

Cardholder data is hosted in the EU under strict EU data residency, while cards are processed in every Visa and Mastercard region.

ACCESS

SAML and OIDC SSO, passkey sign-in, least-privilege roles per organisation and a tamper-evident audit log of every human and API action.

RESILIENCE

Stand-in processing and declared-exposure limits keep cards working through an outage, yours or a network's, inside limits you set.

TESTING

Continuous automated scanning and external penetration tests against the authorization path itself, not only the website.

TRANSPARENCY

SOC 2 report, penetration test summaries, DPA and subprocessor list, shared under NDA from this page rather than after three sales calls.

All systems operational

AUTH API · 99.999% SLALEDGER · 99.999% SLAKYC · 99.999% SLAWEBHOOKS · 99.999% SLA

Send this page to your auditors.

SOC 2 report, DPA and subprocessor list: request access and we share them under NDA the same day.