Stored in the UK
Production data and backups sit in a UK region. Nothing is transferred to a jurisdiction without an adequacy decision.
Security & Compliance
The page your compliance team will read first.
Your data stays in the UK. Credentials are encrypted with authenticated encryption, tenants are separated in the data layer with tests that prove it, and every administrative action is written to an audit log. Send this page to your compliance officer and save the meeting.
UK Co. No.16319763
UK-hostedEU data perimeter
GDPRExport & erasure
PCI · FDFProgramme partner
Audit logChain of custody
UK-hostedPlymouth · EU
UK Co. No. 16319763
Valtura Payments Group Limited, registered in England and Wales. Plymouth, Devon. A real company you can look up.
Export and erasure built in
Per-contact export and erasure are operations in the product, not a support ticket and a fortnight.
Protecting the data
What actually guards your merchant book.
Specifics rather than adjectives, because your compliance officer will ask for specifics.
Acquirer credentials encrypted at rest
Integration credentials and tokens are sealed with AES-256-GCM — authenticated encryption, so tampering is detected rather than merely unlikely. Scoped per ISO and never written to logs.
Two-factor authentication
Time-based one-time codes from any authenticator app, with recovery codes that are themselves hashed rather than stored in the clear.
Passwords are never stored
Only a bcrypt hash is kept. Sign-in runs the same work whether or not the account exists, so the response cannot be used to discover who banks with you.
Encrypted in transit, enforced
HTTPS is required, not merely offered. Every response carries a content security policy and the browser hardening headers that go with it.
Request forgery and abuse controls
State-changing requests carry CSRF tokens, guarded by a test that fails the build if a new form skips them. Rate limits are shared across every running instance rather than per-process.
Audit trail on administrative action
Who did what, when. Written as it happens and readable by your own admins — not a log we hold and you have to ask for.
Keeping ISOs apart
Your book is not visible to anyone else on the platform.
Multi-tenancy is where a payments platform either holds or does not. Ours is enforced in the data layer rather than remembered by each query author, and it is covered by regression tests that exist specifically to fail if a change ever leaks one ISO into another.
Every record is bound to its ISO
Isolation is a property of the data access layer, so a new feature inherits it rather than having to remember it.
Tested, not asserted
Dedicated isolation tests run across routes, background workers and reporting. They exist to catch the leak, not to describe the intention.
Roles and module control
Owners and admins control who sees which modules and which records, per user. Access is removed the moment you remove it.
Compliance
The paperwork questions.
GDPR export and erasure
Subject access export and the right to be forgotten are per-contact operations, covering attachments, activity and audit history — not a scramble across mailboxes.
PCI DSS through Fraud Defence First
PCI programme delivery is run with Fraud Defence First, and referrals are tracked in the platform so you can see the revenue as well as the compliance.
Proposal audit trail
Every proposal carries who generated it, when it was sent, and when the merchant opened it — so a disputed quote is a question with an answer.
KYC in ISO onboarding
UBO collection, document upload and reviewed status tracking are part of onboarding rather than a side process.
Want this in a document for your compliance officer?
Ask and we will send the security pack — data flows, encryption summary, retention and the platform terms — along with answers to anything above that your team wants evidenced.