Skip to content
ShuttleShuttle Docs
Status
View as MarkdownPlain text for AI toolsOpen in ClaudeAsk questions about this pageOpen in ChatGPTAsk questions about this pageOpen in GitHub CopilotAsk questions about this page

Security

Shuttle protects card and customer data with strong authentication, access controls and audit logs, and has its security independently assessed. This page sets out those assessments and how we store and protect data. For what PCI DSS still asks of you when you use Shuttle, see Your PCI DSS obligations.

Our Security Certifications

Section titled “Our Security Certifications”

Shuttle is assessed annually as a PCI DSS Level 1 service provider, has a SOC 2 Type 2 attestation report, and is certified to ISO 27001.

PCI DSS Level 1 Certification

Section titled “PCI DSS Level 1 Certification”

What is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is the card brands’ set of security requirements for protecting card data. It applies to every business that stores, processes or transmits card data, or can affect its security.

What Level 1 means

  • The highest level for service providers: Level 1 applies to service providers that handle more than 300,000 card transactions a year (thresholds vary by card brand) and calls for the most rigorous validation.
  • Independent annual assessment: a Qualified Security Assessor (QSA) assesses our systems every year and issues a Report on Compliance.
  • Attestation of Compliance: our Attestation of Compliance (PCI DSS v4.0.1) summarises that assessment. PCI DSS asks you to check your service providers’ compliance at least once every 12 months (requirement 12.8.4), and this is the document to use.

What it means for you

Using Shuttle reduces your PCI DSS scope: card data stays with Shuttle, so most of the requirements fall to us. It doesn’t remove your own obligations. See Your PCI DSS obligations, and our Shared Responsibility Matrix for the split, requirement by requirement.

SOC2 Type 2 Certification

Section titled “SOC2 Type 2 Certification”

What is SOC 2?

SOC 2 is a reporting framework from the American Institute of Certified Public Accountants (AICPA) for service organisations that hold customer data. An independent CPA firm examines the organisation’s controls and issues an attestation report.

Our Type 2 report

  • Controls tested over time: a Type 2 report covers how our controls operated over a period of at least six months, not only how they were designed at a single point in time (Type 1).
  • Trust Services Criteria: our report covers security, availability, processing integrity, confidentiality and privacy.
  • Independent examination: our systems and processes are examined by an independent CPA firm.

The report is available under NDA to merchants on qualifying plans.

ISO 27001 Certification

Section titled “ISO 27001 Certification”

What is ISO 27001?

ISO 27001 is the international standard for information security management systems (ISMS). It sets out a systematic approach to managing sensitive business information and keeping it secure.

Our certification

  • Information security management system: we run a documented system for establishing, operating and improving information security, certified to ISO/IEC 27001:2022.
  • Risk management: we identify, assess and treat information security risks systematically.
  • Independent audit: an external certification body audits us, with surveillance audits between recertifications.

Regular Penetration Testing

Section titled “Regular Penetration Testing”

What is penetration testing?

Penetration testing simulates attacks on our systems to find vulnerabilities before anyone can exploit them.

Our approach

  • Regular external testing: our systems are tested externally on a regular basis, as our security assessments and certifications require.
  • Vulnerability management: we fix the weaknesses testing finds.

Our Security Commitment

Section titled “Our Security Commitment”

Each of the assessments above is carried out by an independent party and renewed, so our security is checked by someone other than us. The supporting documents are listed under Security Documentation.

Data Storage and Privacy

Section titled “Data Storage and Privacy”

European Data Storage

Section titled “European Data Storage”

All merchant and customer payment data processed through Shuttle is stored within Europe.

GDPR Compliance

Section titled “GDPR Compliance”

What is GDPR?

The General Data Protection Regulation (GDPR) is the European Union’s data protection law. It gives individuals control over their personal data and standardises data protection across Europe.

How we comply

  • Data protection: we process personal data lawfully and securely, to GDPR’s standards for privacy and security.
  • Transparency: we publish clear policies on how we handle payment and personal data.
  • Data subject rights: we support the GDPR rights, including access, rectification, erasure and data portability.

Data Protection Registration

Section titled “Data Protection Registration”

Shuttle is registered with the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection.

ICO Registration Number: ZB059255

View our ICO registration

Security Documentation

Section titled “Security Documentation”

The following security documentation is available:

Was this page helpful?