Payhawk Trust Portal

Everything you need to know about information security and compliance of our platform, company, and services.

Compliance certifications and reports

Payhawk information security program is certified by some of the most stringent boards in the world. Feel free to download any of our certifications or executive summaries below.

iso 27001 certificate

ISO 27001

Our ISO 27001 certification demonstrates our adherence to internationally recognized information security practices - we protect sensitive data from unauthorized access, misuse, disclosure, alteration, and destruction.

soc2 type 2 certificate logo

SOC 2 Type 2

Our SOC2 certification signifies that we’ve implemented rigorous controls to ensure the security, availability, processing integrity, confidentiality, and privacy of customer data as defined by AICPA.

pci dss compliant logo


Our PCI DSS certification ensures the highest level of security for your payment card information. We follow industry best practices, providing a secure environment for processing, transmitting, and storing sensitive data

cyber essentials certificate

Cyber Essentials

Our CE certification confirms that we have implemented crucial controls and safeguards such as secure device configurations, access controls, malware protection, patch management, and firewalls.

Penetration Testing

To ensure our systems are safe and reliable we perform at least annually an internal and external penetration testing. Here you may find our executive report from our last external pentest.

SOC 1 Type 2

Our SOC 1 report is designed to address internal controls over financial reporting and it's focused on both business processes and information technology objectives and testing.


GDPR Compliant

We handle personal data with utmost care, transparency, and respect for individual privacy rights. We prioritize data protection, secure storage, and responsible data usage in accordance with GDPR guidelines.

DORA Compliant

We are one of the early adopters of The Digital Operational Resilience Act (DORA) to ensure we have comprehensive information and communication technology risk management, incident reporting, resilience testing and threat-intelligence sharing.

All your questions about security & compliance at Payhawk

We have compiled a list of commonly asked information security and privacy questions to help you understand our security posture.
If you still don't find the answers you are looking for, we're here to help!

General questions

Information security

Security and Data Protection Compliance

Security Awareness and Training

Physical security

Network Security

Data Protection and Privacy

Access Management

Incident Detection and Monitoring

System Resilience

Business Continuity Planning

Security Incident Reporting and Escalation


Cloud Security