Compliance & Security

VeilPay maintains the highest standards of security and compliance. We undergo regular audits and continuously update our practices to meet evolving regulatory requirements and industry best practices.

Our PCI DSS compliance includes:

• Secure network architecture with firewalls
• Encryption of cardholder data at rest and in transit (AES-256)
• Restricted access to cardholder data
• Regular security testing and monitoring
• Annual on-site assessments by Qualified Security Assessors (QSA)
• Quarterly network vulnerability scans

VeilPay has successfully completed SOC 2 Type II audit, demonstrating our commitment to:

• Security: Protection against unauthorized access
• Availability: System uptime and operational performance
• Confidentiality: Protection of sensitive information
• Privacy: Personal information management

SOC 2 reports available to enterprise customers under NDA.

We fully comply with the General Data Protection Regulation (GDPR) for processing personal data of EU residents. See our dedicated GDPR page for details.

VeilPay implements robust Anti-Money Laundering (AML) and Know Your Customer (KYC) procedures:

• Identity verification for all merchants
• Continuous transaction monitoring
• Suspicious activity reporting (SAR)
• Sanctions screening against OFAC lists
• Beneficial ownership verification

Encryption

• At Rest: AES-256 encryption for all stored data
• In Transit: TLS 1.3 for all connections
• Card Data: Tokenization with no plain text storage
• Keys: HSM-based key management

Infrastructure Security

• Multi-region redundancy with automatic failover
• DDoS protection and rate limiting
• Intrusion detection and prevention systems (IDS/IPS)
• 24/7 security operations center (SOC)
• Regular penetration testing by third-party experts

We implement strict access controls to protect sensitive data:

• Role-based access control (RBAC)
• Multi-factor authentication (MFA) required for all staff
• Principle of least privilege
• Regular access reviews and audits
• Automated deprovisioning for terminated accounts

VeilPay maintains a comprehensive incident response plan:

• 24/7 security monitoring and alerting
• Defined escalation procedures
• Incident response team on call
• Regular incident response drills
• Breach notification protocols meeting regulatory requirements

We carefully vet all third-party service providers:

• Security questionnaires and assessments
• Contractual security requirements
• Regular vendor reviews
• Limited data sharing based on need

All VeilPay employees undergo comprehensive security training:

• Security awareness training upon hire
• Annual refresher training
• Phishing simulation exercises
• PCI DSS and compliance training
• Incident response training

VeilPay undergoes regular third-party audits:

• Annual PCI DSS assessment by QSA
• SOC 2 Type II audit (annual)
• Quarterly vulnerability scans
• Annual penetration testing
• Regular code security reviews

We welcome security researchers to report vulnerabilities through our responsible disclosure program:

Email: security@veilpay.com
PGP Key: Available upon request

We commit to acknowledging reports within 24 hours and providing updates on remediation.

For compliance inquiries or to request documentation:

Email: compliance@veilpay.com
Phone: +1 (415) 555-0123
Address: Compliance Department, VeilPay Inc., 123 Privacy Lane, San Francisco, CA 94102