How data security and protection is embedded into our third-party solution

With InDebted, your data is protected to the highest standards. Our dedicated Information Security team manages the implementation of all information security related policies.

Here’s how we ensure your data remains protected:

Compliant with the industry’s highest standards

InDebted is:

• ISO 27001 certified
• ISO 9001 certified
• PCI-DSS compliant
• SOC Type II compliant

You can view our certifications in our Vanta Trust Report.

ISO 27001: Information Security Management

Our commitment to our ISO 27001 means we ensure the strongest levels of data protection:

• Embedded protocols: State-of-the-art encryption and security to ensure that your customer data remains confidential and secure
• Regular audits: As part of our compliance, we undergo regular security audits, ensuring our systems are impermeable to threats and vulnerabilities
• Risk management: Our risk management processes are fine-tuned to identify potential threats before they materialise, providing our partners with proactive protection

Authorised access only

When accounts are referred to our systems, any customer information can only be accessed by authorised users – in line with our Access Control policy.

Data encryption

From account transfer to payment remittance, sophisticated encryption protects customer data during transfer and storage.

• Data is encrypted at rest
• Secure data transmission protocols to encrypt confidential & sensitive data
• Network is segmented to prevent unauthorised access to customer data
• Confidential data only shared through encryption tools, with expiration dates

Internal data security

Robust internal processes keep our team aligned in maintaining sensitive data. Here are some examples:

• Regular data backups to prevent data loss
• Access requests required with manager authorisation, to ensure that sensitive data is only accessible for team members who need it
• Regular risk assessments performed, to proactively identify any threats
• Recovery plans in place, tested and reviewed regularly to maintain information security continuity
• Company wide mandatory training ensuring all team members understand and uphold our data security measures