COMPANY · SECURITY
Security you can hand to your auditors.
How we protect card data, bank credentials and the money that moves through Sola — and what we can share with your compliance team.
By the numbers
- HMAC signature on every request and callback
- SHA-512
- Encryption for every connection in transit
- TLS 1.2+
- Encryption for data at rest
- AES-256
- Monitoring and on-call incident response
- 24/7
How it is held
Sensitive data sits where regulation says it should — never in the clear.
HOW IT IS HELD
Card data
Cardholder data never touches your systems or ours in the clear. Card entry runs in hosted fields and checkout.
Licensed partners
Regulated payment services are provided by licensed partner institutions in the UK and EU.
Data residency
Processing and storage stay in the UK and EU. Bank credentials stay with the customer’s bank.
- Licensed partner institutions
- UK and EU residency
- Signed callbacks
THE DETAIL LIVES IN /LEGAL
Controls, not promises
Six things we do on every payment, for every merchant.
Card data is tokenised
Card entry runs in hosted fields. Your systems receive a token, never a card number.
Encrypted end to end
TLS 1.2+ on every connection, AES-256 at rest, keys held in a managed HSM.
Strong customer authentication
Pay by Bank is approved in the customer’s own banking app; cards use 3-D Secure.
Least-privilege access
Staff access is role-based, time-limited and behind hardware-key MFA, with every action logged.
Monitored around the clock
Fraud rules and anomaly alerts on every payment, with an on-call engineer 24/7.
Built to stay up
Redundant regions in the UK and EU, tested failover and daily encrypted backups.
Certifications and frameworks
What we are certified against today, and what is in progress. Reports are shared under NDA.
| Framework | Scope | Status |
|---|---|---|
| ISO/IEC 27001 | Information security management across the company | In progress |
| SOC 2 Type II | Security and availability controls | Planned |
| UK GDPR and EU GDPR | Personal data of merchants and their customers | In place |
| PSD2 and SCA | Strong customer authentication on every Pay by Bank payment | In place |
What your team can ask for
We answer security questionnaires in writing, and send the evidence behind the answers.
FOR YOUR COMPLIANCE TEAM
Your security questionnaire
Answered in writing, by the people who run the platform.
Penetration test summary
An annual external test, and how the findings were fixed.
DPA and sub-processor list
Ready to sign, with every sub-processor and where it runs.
FOR YOUR ENGINEERS
Signed callbacks
Verify every callback with its HMAC-SHA-512 signature.
Scoped API keys
Separate keys for sandbox and live, with per-key permissions.
Idempotency and IP allowlists
Retry safely, and accept calls only from your servers.
Need our security pack?
Tell us what your compliance team needs. We send the documents and answer the questionnaire in writing.