Trust & Security
At Tunic Pay, trust is foundational. We believe your data deserves the highest protection, and we hold ourselves to the strictest standards to ensure it. We are ISO 27001 certified and SOC 2 Type 2 compliant: two of the most respected frameworks in information security.
Our credentials
We adhere to the AICPA Trust Services Criteria, and have undergone a full, independent audit over a sustained period to confirm that our internal controls meet standards for security, availability, processing integrity, confidentiality, and privacy in our services.
We are certified under the internationally recognised ISO/IEC 27001 standard. This demonstrates our commitment to a systematic, risk-based approach to managing information security: protecting not just client data, but our internal operations, intellectual property, employee data, and third-party interactions.
We process personal data in line with the UK General Data Protection Regulation and the Data Protection Act 2018. Our Privacy Policy sets out what we collect, why, and your rights.
How we protect your data
These are enforced rigorously and reviewed continuously.
All data (yours and ours) is classified according to sensitivity. Access is strictly limited to the "least privileged" necessary, on a need-to-know basis.
We use strong, industry-standard encryption (TLS, AES etc.) in transit and at rest. Data stored in our systems is encrypted, and communications between our services and with you are always secured.
We use trusted providers, geo-redundant and secure data centres (including EU locations where required), with strong physical and environmental controls.
Regular internal vulnerability scans, patch management, third-party security assessments and penetration tests are integral to our lifecycle.
We continuously monitor for unusual activity, suspicious behaviour, threats. Logs are retained as per policy; we have formal incident response and recovery plans in place.
We evaluate and audit all vendors delivering critical services. All third parties must meet our security standards or better.
"Tunicians" undergo regular training in security best practices: password hygiene, handling sensitive information, recognising phishing, etc. Access controls, multi-factor authentication, and periodic reviews are standard.
How we're built
The specifics your security team will ask about.
Transparency & continuous improvement
We conduct regular audits and reviews of policies and controls.
Our security program is adaptive: we stay up to date with the latest threats, technologies and best practices.
We welcome external audits, independent assessments, and verify that our third-party service providers maintain strong security posture.
Request our security pack or ask a due-diligence question.