Trust Center
What is in place today and what is not
We mark a control as active only when it is live. Nothing on this page is an independent certification unless stated.
Encrypted connections
TLS certificates from Let’s Encrypt with automatic renewal and HTTP Strict Transport Security.
Hardened web security
Strict Content Security Policy with nonces, framing blocked, no third party scripts or trackers.
Account protection
Argon2id password hashing, optional TOTP two factor authentication, CSRF protection, login throttling, sessions that expire after one hour.
Vulnerability disclosure
security.txt published according to RFC 9116; research in good faith is welcome.
Data protection
Data minimisation, export and deletion from within the app, no advertising or analytics cookies.
AML / KYC / sanctions program
Written program with risk assessment, customer due diligence, sanctions screening and reporting procedures. Live screening runs through our partner at launch.
Licensed partner
Accounts, IBANs and cards will be issued by a licensed bank or electronic money institution. Selection is in progress.
Independent legal review
Corporate and compliance documents are drafted and scheduled for review by independent counsel.
Card data security (PCI DSS)
We will never store card numbers; card data will be handled by the card issuer and processor.
ISO 27001 / SOC 2
No independent security certification is held at this time.
Found a vulnerability? Contact us via security.txt · info@royalpaymentsolutions.com