The Service attaches the utmost importance to the security of Users' data and Funds and applies technical and organisational measures designed to protect them. This Security Policy describes such measures in general terms. It is provided for information purposes only; the binding rules on the security of the Personal Cabinet, suspension and risk control are set out in the Terms of Service, the AML & KYC Policy and the Privacy Policy.
1. Data Security
The Service protects User information by means of measures including:
- encrypted data transmission using SSL/TLS;
- restricted access controls, with access granted on a need-to-know basis;
- multi-factor and risk-based authentication;
- secure and monitored hosting environments;
- confidentiality obligations imposed on all personnel with access to User data.
These measures are reviewed periodically in light of technological and legal developments.
2. Security of the Personal Cabinet
The Service uses automated controls to detect and prevent unauthorised access, including monitoring of suspicious sign-in activity and controls restricting the creation of Personal Cabinets from prohibited or high-risk sources. Where the Service identifies a risk to a Personal Cabinet, it may suspend activity, require re-verification or apply the measures set out in the Terms of Service.
The Service identifies the User by the Login Details. Maintaining the confidentiality of the Login Details is essential to security (Section 5).
3. Transaction Monitoring and Fraud Prevention
The Service monitors activity for indicators of fraud, compromise of the Personal Cabinet and other risks, and may hold or review individual transactions where a concern arises. Such monitoring is carried out in accordance with the AML & KYC Policy.
4. Card Security
Cards are issued by a third-party Issuer, not by the Service. Card data and Card transactions are processed in accordance with the security standards of the Issuer and the relevant card schemes. The Service shares Card-related information only to the extent necessary to provide the Services and to prevent fraud and financial crime.
5. Role of the User in Ensuring Security
Ensuring security is a shared responsibility of the Service and the User. In order to protect the Personal Cabinet, the User is advised to:
- keep the Login Details (email address, phone number, Google account and any password or code) confidential;
- secure the email account and phone number used with the Service and remain alert to phishing and SIM swap attempts;
- sign out at the end of each session, in particular on shared devices;
- report any suspicious activity promptly (Section 6).
6. Reporting Security Incidents
Should the User believe that the User's Personal Cabinet, email, phone or Card may have been compromised, or notice any suspicious activity, the User shall notify the Service immediately through customer support in the application or by email to legal@gogocard.me. Reports of potential vulnerabilities may also be submitted to the same address.