Trolley data & platform security policies

Data security

Trolley is certified as SOC 2® Type II compliant by The American Institute of Certified Public Accountants (AICPA) meeting SSAE-21 requirements.

We use end-to-end 256-bit SSL bank-level security. We believe in always-on TLS and maintaining data encryption while at rest and in motion. All passwords and API secrets are one-way hashed using Bcrypt with a factor of 10. API secrets are generated using cryptographically secure random number generators and represent over 128-bits of entropy.

We have built-in tokenization of all sensitive information such as bank account and debit card numbers, government IDs and social security numbers.

Our service operates on Amazon Web Services (AWS) which is certified under several global compliance programmes which underline best practices in terms of data centre security.

• SSAE16/SOC 1, SOC 2 and SOC 3
• ISO 27001 Information Security Management Controls
• PCI-DSS Level 1 Payment Card Standards
• ISO 27018 Personal Data Protection
• FIPS United States Government Security Standards

Privacy

We comply with best practices and regulations about the management of personal data under:

• the European Union General Data Protection Regulation (GDPR)
• the UK Data Protection Act (DPA)
• the California Consumer Privacy Act (CCPA)
• the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)

Trolley is committed to protecting your personal information. For more details, please see our Privacy Policy

Regulatory

Your money, your data and your customer’s data are as important to us as it is to you.Trolley operates through multiple regulated entities depending on customer location:

• Full regulatory information is available here.