Security Policy

1. Security governance

Security responsibilities are assigned across the organisation and reviewed as the platform, threat environment, and legal requirements change. Personnel and service providers receive access only where needed for authorised duties.

2. Core safeguards

• Identity controls, role-based access, and strong authentication for sensitive functions.
• Encryption in transit and appropriate protection for sensitive stored information.
• Secure software development, change control, dependency review, and environment separation.
• Logging, monitoring, alerting, fraud controls, and investigation of suspicious activity.
• Backups, resilience planning, recovery procedures, and supplier-risk management.
• Regular review of vulnerabilities, security configurations, and access permissions.

3. Payment security

Payment requests are routed only to configured providers using protected credentials and authenticated integrations. Tru Payout seeks to minimise exposure to payment credentials and relies on approved payment providers to collect sensitive card details where applicable.

4. Incident response

Suspected incidents are assessed, contained, investigated, remediated, and documented. Where personal information may have been compromised, Tru Payout will notify the Information Regulator and affected data subjects as soon as reasonably possible, unless notification is delayed or restricted by law enforcement or the Regulator.

5. Merchant responsibilities

• Protect account credentials, API keys, webhook secrets, and authorised devices.
• Use least-privilege team access and promptly remove users who no longer require access.
• Keep integration software current and validate payment and webhook responses.
• Notify Tru Payout promptly about suspected compromise, fraud, or unauthorised access.

6. Reporting a security concern

Report suspected vulnerabilities or security incidents to hello@trupayout.com. Include enough detail to reproduce and assess the issue, avoid accessing other users' data, do not disrupt services, and do not publicly disclose the issue before Tru Payout has had a reasonable opportunity to investigate.