Your customers' money, held to bank standards.
Funds sit with our partner banks, every request is encrypted and signed, and independent auditors check our controls every year.
How we protect every transaction
The same controls run behind every account, card and transfer, on every plan.
Encryption everywhere
TLS 1.3 in transit and AES-256 at rest, with keys held in hardware security modules.
Signed requests
Every API call and webhook is signed, so you can verify it came from us and was not changed.
Scoped access
Role based dashboard access, single sign-on and API keys limited to the actions they need.
Fraud monitoring
Real-time rules and models score every transfer and card authorization before it settles.
Segregated funds
Customer balances are held in FDIC insured accounts at partner banks, never on our balance sheet.
Audit logs
Every action in the dashboard and the API is logged and kept for seven years.
Redundant infrastructure
Active in multiple regions with automatic failover and a 99.99% uptime target.
Responsible disclosure
A public bug bounty and a security team that answers reports within one business day.
Controls on every account
The security features you would build yourself, included on every plan from day one.
Backspin
Legacy banks
Encryption everywhere
AES-256 at rest and TLS 1.3 in transit, with keys rotated automatically.
Scoped API keys
Limit each key to the accounts and actions it needs, and revoke it in one click.
Full audit log
Every API call and dashboard action is logged with who, what and when.
Single sign-on
SAML and OIDC for the dashboard, with required two-factor sign-in.
Data residency
All customer data stays in the United States, across two regions.
Audited, certified and ready for your bank partner
Reports and certificates are available under NDA for customers and their auditors.
Request reportsSOC 2 Type II
Audited every year against the security, availability and confidentiality criteria.
PCI DSS Level 1
The highest level for companies that store, process or transmit card data.
Nacha rules
ACH origination, returns and data security follow the Nacha operating rules.
GDPR
Personal data of European customers is processed under a signed data processing agreement.
1 day
First response to every report we receive
Security team
Every day
14 days
To ship a fix for critical issues
Critical
Retested
3
Days to triage and agree on severity
0
Legal actions against good faith research
$5,000
Bounty
Top reward for a critical finding, paid within 30 days of the fix
Report a vulnerability
We will work with you on a fix.
42
Hall of fame
Researchers credited in 2026, including Sofia Lindqvist, Marco Bellini, Lucía Ferrer and 39 more
Questions about security
How we store, protect and audit your data.
All data is stored in the United States, across two regions, encrypted at rest with AES-256 and in transit with TLS 1.3.
Only a small support and compliance team, through audited access that requires a reason and expires after each session.
We complete a SOC 2 Type II audit every year and a PCI DSS Level 1 assessment for card data. Reports are shared under NDA.
Independent firms test the platform twice a year, and every finding is tracked until it is fixed and retested.
We notify affected customers and partner banks within 72 hours, with what happened, what was affected and what we are doing about it.
Yes. The dashboard supports SAML and OIDC single sign-on, with role-based permissions and required two-factor sign-in.