Cybersecurity Awareness Month: Why We Signed the Collective Cyberdefense Pledge

Spreedly joined the industry's largest coordinated pledge on AI-era cyber defense. Here's what that means, plus a look at the security work that's kept us busy all year.

Happy Cybersecurity Awareness Month! October is a good excuse to talk about something we think about every single day.

So let's start with some news. Spreedly signed OpenAI's Collective Cyberdefense open letter. We're in great company, too. Microsoft, Google, Cisco, IBM, Anthropic, Mastercard, and CrowdStrike are all on the list, alongside dozens of other organizations committed to the same goal: stronger defenses against AI-enabled threats.

The letter asks for action on three fronts:

• Fix the basics. Unpatched systems, misconfigurations, and weak authentication still leave too many doors open.
• Put AI to work for defenders. The same tools that make attacks cheaper can help security teams close gaps faster.
• Defend together. Threats cross borders in seconds. Defense works best when it's shared.

For us, signing was easy. Security has always been the foundation Spreedly is built on. We tokenize and store payment methods, route and retry transactions, and manage gateway connections for merchants, platforms, and fintechs. That's a lot of trust to carry, and we take it seriously.

What changes for you? Nothing in how Vault, Optimize, Connect, Resolve, or Protect work today. What it does mean: we've publicly lined up with the leading AI companies, security vendors, and financial institutions to raise the bar everywhere payments meet AI.

What we've been up to this year

That letter is really important to us, but what we focus on every day is making sure that we have the best security available for our customers. Here’s a look at how our security program has grown in the last year. 

1. Another clean PCI DSS assessment

We wrapped our 2026 PCI DSS audit period, and our assessor confirmed in writing that we met every requirement. Our official Attestation of Compliance is on its way, expected by the end of October. That keeps our Level 1 service provider status going strong, along with the PCI DSS 4.0 compliance we've held since April 2025.

2. SOC 2 Type II, working hand in hand with PCI

Our SOC 2 Type II program checks how we protect data every single day, not just on audit day. We use our PCI evidence to make it efficient, so our security team spends less time on paperwork and more time on protection. Need the report? It's available on request through our Trust Center page.

3. Practicing for the bad day, so it stays a good day

This month our Business Resiliency Program is running its annual drills, including an employee emergency alert test and a full review of our Business Continuity Plan. It’s a fun addition to the work we do all year: multiple penetration tests, phishing simulations, ransomware tabletop exercises, and an annual disaster recovery test.

Your October security checklist

This year's Cybersecurity Awareness Month theme from the National Cybersecurity Alliance is "Don't Make It Easy for Them." We love that. Small habits add up. Here are five easy wins for your payments stack:

1. Turn on MFA everywhere. Your dashboard, your gateways, your email. It's the cheapest lock you'll ever buy.
2. Review who has access. People change roles. Use role-based permissions and remove access nobody needs.
3. Check your security settings. If you use Spreedly, make sure Enhanced Security is on and you're validating signatures. Most issues we see start with a setting, not a breach.
4. Shrink your PCI scope. Tokenize early. The less raw card data touches your systems, the less there is to protect.
5. Practice your response plan. Run a tabletop exercise this quarter. A plan you've rehearsed beats a plan in a drawer.

Closing

Security never really finishes. There's always another patch, another test, another habit worth building. We're glad to do that work alongside you, and alongside an industry that's finally pulling in the same direction.

If you’d like to learn more about security, we’ve got a lot of amazing resources for you! Start at our Master Guide to PCI Compliance and browse the rest of our Payments Security content here.  Stay safe out there, and Happy Cybersecurity Awareness Month!