Security / trust page — Payhawk

Cited by

Facts read from this source

• Providers Report an error

  “Payhawk uses Amazon AWS for infrastructure and Google Cloud Platform GCP for data center hosting.”

• Providers certifications Report an error

  “Both service providers are certified as ISO 27001, PCI DSS Service Provider Level 1, and or SOC 1 and 2 compliant.”

• Security email Report an error

  “You can reach our security team at security@payhawk.com”

• Security team Report an error

  “Payhawk has a dedicated and passionate security and operations team to respond to security alerts and events.”

• Pentest Report an error

  “Third-party penetration tests are conducted against the application and supporting infrastructure at least annually. Any findings as a result of tests are tracked to remediation. Reports are available on request with an appropriate NDA in place.”

• Threat detection Report an error

  “Payhawk leverages threat detection services within AWS to continuously monitor for malicious and unauthorized activity.”

• Vulnerability scanning Report an error

  “We perform regular internal scans for vulnerability scanning of infrastructure and applications.”

• Ddos protection Report an error

  “We utilize AWS Shield’s sophisticated CDN with built-in DDoS protection as well as native AWS tools and application-specific mitigation techniques.”

• Access control Report an error

  “This is subject to frequent internal audits and technical enforcement and monitoring to ensure compliance. 2FA is required for all production systems.”

• Encryption in transit Report an error

  “Communication with Payhawk is encrypted with TLS 1.2 or higher over public networks.”

• Encryption at rest Report an error

  “Payhawk data is encrypted at rest with industry-standard AES-256 encryption. By default, we encrypt at the asset or object level.”

• Availability Report an error

  “Services are deployed to multiple availability zones for availability and are configured to scale dynamically in response to measured and expected load.”

• Disaster recovery Report an error

  “In the event of a major region outage, Payhawk has the ability to deploy our application to a new hosting region. Our Disaster Recovery plan ensures the availability of services and ease of recovery in the event of such a disaster. This plan is regularly tested and reviewed for areas of improvement or automation.”

• Environment segregation Report an error

  “Testing, staging, and production environments are separated from one another. No customer data is used in any non-production environment.”

• Security champions Report an error

  “Payhawk runs a Security Champions program with involvement and contributions from each of the development teams.”

• Security awareness training Report an error

  “Payhawk has a robust Security Awareness Training program which is delivered within 30 days of new hires and annually for all employees.”

• Security policies Report an error

  “Payhawk has a comprehensive set of information security policies covering a range of topics. These are disseminated to all employees and contractors and acknowledgment tracked on key policies such as Acceptable Use and Information Security Policy.”

• Access review Report an error

  “Business need revalidation is performed on a quarterly basis to determine that access is commensurate with the user’s job function. Exceptions identified during the revalidation process are remediated. User access is revoked upon termination of employment or change of job role.”

• DPA available Report an error

  “Data Processing Addendum”

• Vendor management Report an error

  “Payhawk understands the risks associated with improper vendor management. We evaluate and are subject to a supplier onboarding process and steps on all of our vendors prior to engagement to ensure their security is to a suitable standard.”

• Notification providers Report an error

  “For the purpose of operations, marketing and sales we may use the following 3rd party providers to send you a notification on our behalf: TrustPilot, MailJet, Amazon SES, SendGrid, Chargebee, Livestorm, SalesLoft.”

• Card issuers Report an error

  “Payhawk Debit and Credit Cards are issued by Payhawk Financial Services UAB in the EEA, Payhawk Financial Services Limited in the UK, and Cross River Bank, Member FDIC in the US.”

• UK restriction Report an error

  “The Payhawk product is not available for micro-enterprises or small charities based in the UK as defined in the UK Consumer Duty Regulations.”

• Card licensor Report an error

  “The Payhawk Visa Debit card and Payhawk Visa Credit cards are issued pursuant to a license from Visa.”

• Channels Report an error

  “Support support@payhawk.com Sales sales@payhawk.com”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Controller European sovereignty
• The Finance Lead European sovereignty
• The Office Manager Approval workflows & expense policy
• The Office Manager European sovereignty
• The Skeptic European sovereignty
• The Tax Adviser Approval workflows & expense policy
• The Tax Adviser European sovereignty
• The Travelling Employee European sovereignty