Snapshot 231789
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Overview At PCI Pal, protecting our customers’ data is more than a priority, it’s part of who we are. We’re committed maintaining trust through complete transparency, robust security practices, and a deep respect for data privacy. Our Trust Center is your central resource for understanding how PCI Pal safeguards sensitive information, complies with global standards, and helps your organization deliver secure and seamless customer experiences. Explore our Trust Center to learn about our security posture, certifications, and privacy commitments — and request access to detailed security and compliance documentation that demonstrates our dedication to keeping our business and customers safe. Knowledge Base (FAQ) Compliance Cyber Essentials Cyber Essentials Plus ISO 14001:2015 ISO 22301 ISO 9001:2015 ISO/IEC 27001 PCI DSS GDPR HIPAA ISO/IEC 42001:2023 SOC 2 Type 2 PCI Pal is reviewed and trusted by Archer ServiceNow ProcessUnity OneTrust UpGuard Documents POLICIESAcceptable Use Policy ESGAnti-Bribery and Corruption ESGAnti-Modern Slavery LEGALAnti-Money Laundering Policy POLICIESAsset Authorization and Monitoring Policy POLICIESAsset Management Policy BC/DRBusiness Continuity Plan (BCP) POLICIESBusiness Continuity/Disaster Recovery (BC/DR) Policy POLICIESChange Management Policy POLICIESCode of Conduct Policy COMPLIANCECyber Essentials Plus LEGALCyber Insurance Risk Profile Data Access LevelRestricted Third Party DependenceYes HostingMajor Cloud Provider Reports PCI DSS Service Provider Charter Data Flow Diagram (DFD) PCI PAL's Shared Responsibility Matrix View more Security Grades Qualys SSL Labs https://www.pcipal.com/ A Policies Acceptable Use Policy Asset Authorization and Monitoring Policy Asset Management Policy View more Self-Assessments PCI Pal : Security Self Assessment Questionnaire PCI Pal : Standardised Privacy Assessment Legal Subprocessors Privacy Policy Terms of Service View more Corporate Security Asset Management Practices Email Protection Employee Training View more Access Control Data Access Device Lock Least Privilege View more Risk Management Data Access/Impact Levels Risk Assessments Supply Chain Risk Management Incident Response Incident Response Plan Data Privacy Cookies Data Breach Notifications Data Into System View more ESG Anti-Bribery and Corruption Anti-Modern Slavery Diversity, Equity, and Inclusion View more Physical & Environment Alarms & Surveillance Alternate Work Sites Remote Telework Network Security Data Loss Prevention Firewall IDS/IPS View more AI AI Overview AI Security AI Risk Management View more App Security We take application security seriously and are putting together a program to monitor internal apps. Asset Management We have strict asset management policies in place to ensure that all assets are accounted for and secure. BC/DR Business Continuity Plan (BCP) Contingency Training/Simulations Change Management We have a change and configuration management process in place to ensure that changes are properly reviewed and approved. Continuous Monitoring We continuously monitor our systems for security threats and vulnerabilities. We are happy to provide more details about our continuous monitoring practices upon request. Data Security We follow industry best practices for data security. We are happy to provide more details about our data security practices upon request. Endpoint Security We follow industry best practices for endpoint security. We are happy to provide more details about our endpoint security practices upon request. Infrastructure We take great care to work with best-in-class infrastructure providers that provide secure computing and storage. We are happy to provide more details about our infrastructure upon request. Product Security We pay great attention to enterprise features such as access control and single sign on. We are happy to provide more details about our enterprise features upon request. Training We provide security awareness training to all employees to ensure that they are aware of security best practices. Subprocessors Company Purpose Location Amazon Web Services (AWS) PCI Pal uses Amazon Web Services (AWS) as a cloud infrastructure sub-processor to host elements of its service delivery platform, including database services (Amazon RDS). AWS provides secure, resilient cloud hosting infrastructure that underpins the availability and performance of PCI Pal's solutions. AWS maintains its own extensive compliance certifications (including ISO 27001, SOC 2, and PCI DSS) and operates under a Shared Responsibility Model, with AWS responsible for the security of the cloud and PCI Pal responsible for the security in the cloud. Further detail on AWS's compliance posture is available via the AWS GDPR Centre and AWS Artifact. Global Microsoft Azure PCI Pal uses Microsoft Azure Cognitive Services (Speech) as a sub-processor to provide speech-to-text functionality within its solutions. This service supports voice-based interactions as part of PCI Pal's omni-channel offering. Microsoft operates under its own extensive compliance certifications (including ISO 27001, SOC 2, and PCI DSS) and provides a documented Service Level Agreement (99.9% availability). As part of PCI Pal's resilience planning, a DTMF (touch-tone) fallback mechanism is in place, and an alternative speech-to-text provider has been identified, should service continuity be impacted. Further detail on Microsoft's compliance posture is available via the Microsoft Service Trust Portal. Global Elastic PCI Pal uses Elastic as a sub-processor to support logging, search, and monitoring functions within its technical infrastructure. Elastic operates under its own compliance certifications and provides a Data Processing Agreement (DPA) governing the processing of any personal data involved. Further detail on Elastic's compliance posture is available via Elastic's Trust and security documentation. EU, US, UK Datadog Real-time cloud monitoring and observability platform that tracks metrics, logs, and traces across applications, servers, and infrastructure. US, EU DocuSign PCI Pal uses DocuSign as a sub-processor to facilitate secure electronic signature and document execution processes. This supports the handling of contracts, agreements, and related documentation as part of PCI Pal's business operations. DocuSign operates under its own extensive compliance certifications (including ISO 27001 and SOC 2) and maintains a Data Processing Agreement (DPA) governing the processing of any personal data involved. Further detail on DocuSign's compliance posture is available via the DocuSign Trust Centre. US, EU Salesforce PCI Pal uses Salesforce as a sub-processor to support customer relationship management (CRM) activities, including the storage and management of customer and prospect data. Salesforce operates under its own extensive compliance certifications (including ISO 27001, SOC 2, and PCI DSS) and maintains a Data Processing Agreement (DPA) and Transfer Agreement governing the processing and international transfer of any personal data involved. Further detail on Salesforce's compliance posture is available via the Salesforce Trust site. Global Microsoft 365 PCI Pal uses Microsoft 365 as a sub-processor to support core business operations, including email, collaboration, and document storage (via Teams and related services). Microsoft operates under its own extensive compliance certifications (including ISO 27001, SOC 2, and PCI DSS) and provides a documented Service Level Agreement (99.9% availability). Further detail on Microsoft's compliance posture is available via the Microsoft Service Trust Portal. Global Jira PCI Pal uses Atlassian (Jira) as a sub-processor to support project and work management activities, including issue tracking and workflow coordination across teams. Atlassian operates under its own extensive compliance certifications (including ISO 27001 and SOC 2) and maintains a Data Processing Agreement (DPA) governing the processing of any personal data involved. Further detail on Atlassian's compliance posture is available via the Atlassian Trust Centre. US, EU SafeBase PCI Pal uses SafeBase (Advanced package) as a sub-processor to operate its Trust Centre and to automate responses to customer and prospect security questionnaires. The platform maintains a trust content library of approved question-and-answer pairs and matches incoming questionnaire questions against this library to generate draft responses for human review. SafeBase is a vendor-hosted, cloud-based platform — PCI Pal does not provision or maintain any underlying infrastructure — and integrates with Salesforce to verify account and NDA/commercial status as part of the Trust Centre access process. Further detail on SafeBase's compliance posture is available via the SafeBase Trust Centre. US LinkedIn PCI Pal uses LinkedIn Sales Navigator as a sub-processor to support sales prospecting and business development activities, including identifying and researching prospective customer contacts. LinkedIn operates under its own compliance certifications and maintains a Data Processing Agreement (DPA) governing the processing of any personal data involved. Further detail on LinkedIn's compliance posture is available via the LinkedIn Trust Centre. US Ironclad PCI Pal uses Ironclad as a sub-processor to support contract lifecycle management, including the drafting, review, approval, and archiving of contracts and related agreements. Ironclad operates under its own compliance certifications and maintains documentation governing the processing of any personal data involved. Further detail on Ironclad's compliance posture is available via the Ironclad Trust Centre. US Amplemarket PCI Pal uses Amplemarket as a sub-processor to support sales prospecting and outreach activities, including identifying, enriching, and engaging prospective customer contacts. Amplemarket operates under its own compliance certifications and maintains documentation governing the processing of any personal data involved. Further detail on Amplemarket's compliance posture is available via the Amplemarket Trust Centre. US Allego PCI Pal uses Allego as a sub-processor to support sales enablement activities, including training content delivery and sales call/presentation review. Allego operates under its own compliance certifications and maintains documentation governing the processing of any personal data involved. Further detail on Allego's compliance posture is available via the Allego Trust Centre. US If you think you may have discovered a vulnerability, please send us a note. Report issue