Security — Astrada
Security by design
Astrada is built on enterprise-grade security principles. Handling card transaction data is a responsibility we take seriously — our infrastructure is designed to meet the most demanding requirements.
Certifications & Practices
PCI DSS v4 Level 1
Certified as a PCI DSS v4 Level 1 Service Provider — the highest level of payment card industry compliance.
TLS 1.2 / 1.3 Encryption
All communications are encrypted with TLS 1.2 or TLS 1.3. Data at rest is encrypted with AES-256.
GDPR & CCPA Compliant
Full compliance with GDPR and CCPA regulatory frameworks. Data processing agreements available on request.
OAuth2 Authentication
API-based OAuth2 authentication with scoped access tokens and automatic token rotation.
Penetration Testing
Regular third-party security penetration testing conducted by independent security firms.
ASV Scans
Frequent Approved Scanning Vendor (ASV) scans to identify and address vulnerabilities proactively.
Common security questions
How can I verify Astrada's PCI DSS compliance?
Astrada is certified as a PCI DSS v4 Level 1 Service Provider. You can request our Attestation of Compliance (AOC) by contacting security@astrada.co.
Is Astrada compliant with GDPR and CCPA?
Yes. Astrada is fully compliant with both GDPR and CCPA. We provide Data Processing Agreements (DPAs) to all customers upon request.
How is data encrypted?
All data in transit is encrypted using HTTPS with TLS 1.2 or TLS 1.3. Data at rest is encrypted using AES-256 encryption.
Can I see a list of your sub-processors?
Yes. A current list of sub-processors is available on request. Contact privacy@astrada.co for details.
Can I access penetration test reports?
Summary findings from our most recent third-party penetration test are available under NDA. Contact security@astrada.co to request access.
How do I report a security vulnerability?
If you believe you have found a security vulnerability, please report it responsibly by emailing security@astrada.co. We take all reports seriously and will respond promptly.
Does Astrada have a bug bounty program?
We do not currently operate a bug bounty program. However, we welcome responsible disclosure of any security issues via security@astrada.co.
How can I verify the security of Astrada's products?
We can provide our PCI DSS AOC, penetration test summaries (under NDA), and details of our security architecture during your evaluation process. Reach out to security@astrada.co to get started.
Get in touch
For security inquiries, compliance documentation, or privacy requests.
Security
Compliance docs, vulnerability reports
Privacy
DPAs, data subject requests
Support
Technical support, account issues
Build with confidence
Enterprise-grade security infrastructure, so you can focus on building your platform.