Trust Center

Nothing’s more important than your peace of mind and confidence when processing a transaction through the Spreedly platform.

Want to learn more about Spreedly’s security capabilities?

Spreedly is part of the Cloud Security Alliance (CSA) STAR Program

Learn more about Spreedly's level 1 self-assessment

View Spreedly's CAIQ
Spreedly’s Whistic Security Profile includes detailed information about our security and compliance program including but not limited to our SOC 2 Type 2 report, executive penetration testing summaries, privacy program details, etc.

Sign our NDA and then be provided access to review our Security Profile in Whistic.

See Our Whistic Security Profile
Spreedly also maintains an "A" for our Security Scorecard score click below for the details.

See how Spreedly maintains an “A”

See Our Security Scorecard
Compliance

Our compliance program focuses on the identification and implementation of relevant legislative statutory, regulatory, and contractual controls to ensure ongoing compliance for Spreedly and its customers.

Corporate Security

Ongoing Security Evaluation: Vulnerability Management / Penetration Testing / Red-Team Exercises

Security

Security at Spreedly is at the core of the Payments Orchestration service we provide our customers and we take this responsibility very seriously. Spreedly’s information security program leverages the Secure Controls Framework™

Resources

Compliance

Our compliance program focuses on the identification and implementation of relevant legislative statutory, regulatory, and contractual controls to ensure ongoing compliance for Spreedly and its customers.

View Our Attestation Of Compliance
SOC 2 Type 2

Spreedly has passed its SOC 2 Type 2 audit with no exceptions. System and Organization Controls (SOC) is a suite of service offerings Certified Public Accountants (CPAs) provide in connection with system-level controls of a service organization or entity-level controls of other organizations.

Request Spreedly’s SOC 2 Type 2
Status Page

Customer impacting incidents along with post-mortems are posted on our StatusPage. Customers can subscribe to receive real-time incident notifications via this same link

View Our Status Page
Privacy Program

Our privacy program includes but is not limited to a comprehensive data classification and handling policy along with directive and technical controls for data retention, sanitization, loss/leakage prevention, masking, and encryption at rest and in transit.

View Spreedly’s Privacy Policy

FAQ

Is Spreedly Level 1 PCI Compliance?

Spreedly is Level 1 PCI compliant — the highest and strictest level — and is on the Visa Global Registry of Service Providers and the Mastercard SDP Compliant Registered Service Provider list. You can find our supporting documentation on our PCI page. You can also view our attestation of compliance here.

Is Spreedly a Member Of The PCI Security Standards Council  (PCI SSC)?

Spreedly partners with other participating organizations to work with the PCI SSC to help secure payment data worldwide through the ongoing development and adoption of the PCI Security Standards. Learn more about our participation here.

Has Spreedly Obtained A SOC 2 Type 2 Certification?

Spreedly has passed its SOC 2 Type 2 audit with no exceptions. System and Organization Controls (SOC) is a suite of service offerings Certified Public Accountants (CPAs) provide in connection with system-level controls of a service organization or entity-level controls of other organizations. It is a reporting framework through which organizations can communicate relevant information about the effectiveness of their cybersecurity risk management program. It also allows CPAs to report on such information to meet the cybersecurity information needs of a broad range of stakeholders.

SOC 2, which stands for Service Organization Control 2, is an audit that deals with a service organization’s controls around protection and privacy of data. SOC 2 was designed by the AICPA for service providers storing customer data in the cloud. SOC 2 is an auditing and reporting engagement for companies that have cloud infrastructure.

To request a copy of Spreedly’s SOC 2 Type 2, contact us.

Is Spreedly EMVCo Certified?

Spreedly’s 3DS2 solution is a multi-factor authentication protocol used to confirm digital identity during card not present checkout to prevent fraud. The solution is EMVCo certified including our iOS and Android SDKs as well.

Does Spreedly Support Network Tokenization?

Spreedly is a vendor neutral Network Token Provider and certified with both Visa and Mastercard. Knowing that Network Tokenization requires a cryptogram on the initial creation this provides an added layer of security when vaulting and using cards for future use. More information can be found here.

Is Spreedly’s Hosting Secure?

Spreedly operates in a cloud based environment via AWS with multiple mechanisms in place to ensure resiliency and business continuity. For more information please reference the AWS datacenter PCI L1 compliance page, which certifies extensive physical protections as well, and houses various other banking, government, and security agencies.

How Does Spreedly Protect Your Data?

Spreedly requires TLS v1.2 for its Core transactional API when supported by the connecting client. Beyond that single requirement, Spreedly’s secure configuration currently warrants an A+ rating from SSL Labs, meaning that Spreedly’s website security is resilient to attacks exploiting older weaker TLS versions.Spreedly uses the Advanced Encryption Standard (AES) with 256-bit keys when encrypting confidential data within the vault.  Each confidential record within the vault is encrypted using a separate, randomly generated, encryption key.  This key itself is then further protected by encrypting with an asymmetric key (RSA, 2048 bits).More details about Spreedly’s privacy program can be found here.

Does Spreedly Have Vulnerability Management and Penetration Testing?

Spreedly leverages several reputable outside sources for threat intelligence. Ongoing, internal and external independent, recurring third party vulnerability scanning and multiple yearly penetration tests are the proactive measures we use to identify security vulnerabilities within our environment. We take a methodical risk based approach when managing vulnerabilities that align to Spreedly’s risk appetite and tolerance. Remediation timelines are based on industry standards and account for the agility needed to address zero day vulnerabilities.

Spreedly also performs social engineering tests such as phishing campaigns on a regular basis in addition to table top exercises that seek to assess and improve our incident response to common likely and impactful threats such as ransomware.

What Is Spreedly ID?

Protecting data and customers with a suite of layered security tools that work in concert to keep all Spreedly customers’ safe. This comprehensive set of security functionality allows customers to limit security breaches, protect PCI data, and avoid malicious network access.

Encryption in Transit
When connecting to Spreedly ID, all data is encrypted in transit using only supported TLS protocols.

Password Best Practices
Longer passwords are harder to guess/crack. Spreedly recommends creating passwords using passphrases. Passphrases are made up of longer sentences and/or words that are meaningful to a user (and not others) that allows one to more easily remember a password without writing it down. Session timeouts due to inactivity and forced log outs are also in place.

Multi-Factor Authentication (MFA)
MFA is a required protection for all Spreedly ID access. MFA enhances security by requiring another factor of login verification to Spreedly administration tools versus just a single username and password. A necessity to strengthen defenses – Multi-Factor Authentication (MFA) goes a long way in protecting sensitive PCI data and network access. While it’s never possible to stop all data breaches and attacks, MFA can help merchants reduce the likelihood of a cyberattack.

Role-Based Access Control (RBAC)
Compartmentalize access to sensitive areas of your Spreedly administrative tools: Security keys, reporting, and more by leveraging RBAC. Spreedly offers several pre-configured roles to ensure the appropriate administration and needed separation for specific functions.Organizations can manage their own users’ access to sensitive company information by selecting the appropriate role(s) of key customer stakeholders. These user access controls result in a more secure method for employees to access the unique information they need to do their jobs and prevents them from accessing information that doesn't pertain to them.

Does Spreedly Provide Security Advisories?

Spreedly will provide security notifications here related to potential threats to Spreedly information systems, our response, current status, and risk posture.

Does Spreedly Have Ongoing Security Evaluations?

These terms mean different things to different organizations but they each share in representing a continuum of constantly assessing and improving information security — from known patchable vulnerabilities, syntactical coding exploits, and semantic process deficiencies. Spreedly performs all three of these assessment types (including social engineering tests such as phishing tests) on a regular basis in addition to process-only table top exercises that seek to assess and improve our incident response to common likely and impactful threats such as ransomware.

Does Spreedly Take A Layered Approach to Security?

From an architectural perspective, Spreedly seeks to embrace zero trust security ideals where access to resources are fully authenticated, fully authorized, and fully encrypted based upon user credentials (with Multi-Factor Authentication) from inventoried and managed devices. And we measure our resilient information security posture against the Secure Controls Framework (SCF), bettering our ability to prevent, detect, and respond to information security attacks. We also maintain an "A" for our Security Scorecard score click below for the details.

What Are Spreedly’s Privacy Controls?

Spreedly leverages layers of controls to ensure the privacy and protection of customer data. Our privacy program includes but is not limited to a comprehensive data classification and handling policy along with directive and technical controls for data retention, sanitization, loss/leakage prevention, masking, and encryption at rest and in transit.

Is Spreedly GDPR Compliant?

Spreedly is General Data Protection Regulation (GDPR) compliant, and maintains GDPR compliance for all the processors and sub processors in our technology stack where we decide on your behalf how data will be processed. More information about our GDPR compliance can be found here.

Is Spreedly A Member Of Privacy Shield?

Spreedly complies with EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework. Learn more about the Data Privacy Framework (DPF) program, and view our certification here. Spreedly also utilizes Standard Contractual Clauses with EU Data Controllers to ensure compliance with EU law regarding data protection.

What’s Spreedly’s Privacy Policy?

View our Privacy Policy here.

If you need to modify the Privacy Controls for this site click "Privacy Settings" located at the bottom of every page.

How Secure Is Spreedly’s Hosting?

Spreedly operates in a cloud based environment via AWS with multiple mechanisms in place to ensure resiliency and business continuity. For more information please reference the AWS datacenter PCI L1 compliance page, which certifies extensive physical protections as well, and houses various other banking, government, and security agencies.

Does Spreedly Offer Monitoring, Logging, & Alerting?

Several observability tools are leveraged to monitor the four golden signals of latency, traffic, errors, and saturation utilizing synthetic transactions and other technical measures to address issues before they cause customer impact. Comprehensive logging is in place for key activities along with automated alerting that initiates Spreedly’s incident response process.

What Are Spreedly’s Incident Response Procedures?

Spreedly maintains an Incident Response (IR) policy and procedures for detecting, monitoring and responding to actual or reasonably suspected intrusions and security incidents, and reporting actual or reasonably suspected security or privacy incidents. Incident Commanders and Incident Response Teams receive annual training and participate in regular IR exercises.Problem management processes are in place to ensure post-incident review of events along with a root cause analysis is conducted with actions taken to prevent recurrence.

Does Spreedly Have Business Continuity and Disaster Recovery Plans?

Spreedly reviews its business continuity plan at least annually and conducts regular tabletop exercises to address business continuity of key people, processes, and third parties. An annual disaster recovery exercise for critical technology resiliency is in place to confirm we can meet our Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

Spreedly’s card data environment (CDE) is architected in a resilient manner via multiple availability zones in multiple AWS regions.

Does Spreedly Have A Status Page?

Customer impacting incidents along with post-mortems are posted on our StatusPage. Customers can subscribe to receive real-time incident notifications via this same link.We pride ourselves in providing at least 99.9% uptime for services related to Payment Orchestration.

Does Spreedly Have A Security.txt Page?

Contact: mailto:security@spreedly.com
Expires: 2024-06-30T13:00:00.000Z
Preferred-Languages: en

Spreedly Can Answer All Of Your Security Questions

Spreedly Support

Reach out to payments security experts to get specific answers to security and compliance questions.

Contact Support
Knowledge Base

Find more information about common security and company questions written by Spreedly experts.

Access Our Knowledge Base
Community

Ask questions about security and compliance and get feedback from peers and Spreedly experts.

Access The Community

Hundreds of Organizations Trust Spreedly

Organizations trust us to handle $50 billion in transactions through over 1 billion stored payment methods.