Security first.
Security is a priority at Spendesk - we value the integrity of your personal data as much as we do our own. We’re committed to protecting all your company spending with the highest security and privacy standards.
Security at Spendesk
Security on the platform
Spendesk databases are encrypted and automatically backed up every day. We use firewalls, encrypt passwords, verify the payer for every transaction, and automatically log users out after their session. Our databases and servers are hosted and maintained by AWS (Amazon Web Services).
Advanced Security and Access Control
Our reliable and robust security measures evolve to anticipate future risks, ensuring your financial data remains secure. Control employee access to Spendesk with SAML SSO via single sign-on portals like Microsoft Azure, OneLogin, and Okta.
Fraud detection algorithm
The Spendesk platform is equipped with a fraud detection algorithm that notifies account owners about any potential fraud or suspicious online payment activity in a weekly Security Report.
Privacy Policy
Spendesk places the utmost importance on the security and integrity of the personal data entrusted to it. We take all necessary precautions to preserve data security and protect against any incident. Read more
Labels & Regulations - Security Certifications
General Data Protection Regulation (GDPR)
We’ve strengthened our internal processes to ensure control over the processing of your personal information, including the ability to override cookie tracking and secure browsing in Spendesk.
On the recommendation of the CNIL for companies, Spendesk does not store your account password or your card numbers.
)
Payment Card Industry Data Security Standard (PCI DSS)
Spendesk’s partners are certified with the PCI Data Security Standard, an information security standard for organizations that handle branded credit cards from the major card providers. It increases controls around cardholder data to reduce credit card fraud.
PSD2 & SCA
SCA is a new European regulatory requirement to reduce fraud and make online payments more secure. The purpose is to strengthen the level of payment security and protect consumers by imposing strong authentication procedures for account access and payment transactions.
Under PSD2, strong authentication involves a verification at each account access and transaction level, using at least two of the following means: a password or code that only the user knows; a device (mobile phone or smart card) that only the user has; a personal characteristic of the customer (fingerprint, voice, or facial recognition).
3-D Secure
This protocol helps to reduce fraud and provide extra security for online payments. It ensures authentication by receiving a push notification and confirming the payment via biometric/security code directly on the Spendesk app, or sending you a text message with a unique code, only available for 5 minutes.
General Data Protection Regulation (GDPR)
We’ve strengthened our internal processes to ensure control over the processing of your personal information, including the ability to override cookie tracking and secure browsing in Spendesk.
On the recommendation of the CNIL for companies, Spendesk does not store your account password or your card numbers.
Payment Card Industry Data Security Standard (PCI DSS)
Spendesk’s partners are certified with the PCI Data Security Standard, an information security standard for organizations that handle branded credit cards from the major card providers. It increases controls around cardholder data to reduce credit card fraud.
PSD2 & SCA
SCA is a new European regulatory requirement to reduce fraud and make online payments more secure. The purpose is to strengthen the level of payment security and protect consumers by imposing strong authentication procedures for account access and payment transactions.
Under PSD2, strong authentication involves a verification at each account access and transaction level, using at least two of the following means: a password or code that only the user knows; a device (mobile phone or smart card) that only the user has; a personal characteristic of the customer (fingerprint, voice, or facial recognition).
3-D Secure
This protocol helps to reduce fraud and provide extra security for online payments. It ensures authentication by receiving a push notification and confirming the payment via biometric/security code directly on the Spendesk app, or sending you a text message with a unique code, only available for 5 minutes.
ACHILLE MANBOU, FINANCIAL CONTROLLER AT WE ARE SOCIAL
Thanks to Spendesk virtual cards, our teams can quickly and easily pay for things online. And it's very secure, so that minimizes our risk of fraud.Learn more
)
Communications agency, London, United Kingdom
Most frequently asked questions
View some of the most common questions and answers related to Spendesk security.
Spendesk is not a bank although it has a Payment Institution license in Europe. When loading your Spendesk account, your funds will be credited to an account opened in your name and segregated in the book of a partner Credit Institution.
Our partner payment services providers secure the third party funds collected by opening and maintaining segregation accounts in the books of a credit institution. The segregated accounts allow a clear separation between third party funds (your funds) and the payment services providers' funds, so that your funds are never misused and protected against actions from the payment services providers' creditors.
Spendesk provides a dematerialisation service with probative value on demand of the company and complies with the regulatory requirements, and uses a storage solution to ensure that these documents are kept for at least 10 years.
This process consists of:
Tracking receipts uploaded to Spendesk via mobile app, desktop app and email.
Generating a PDF file of the receipt.
Signing the PDF file with an electronic seal based on a qualified certificate.
Archiving the invoice on an ISO 27001 compliant server during the entire legal period.
Thus,The image is transmitted securely and uninterruptedly to the server (AWS S3).
The images obtained via HTTPS protocol will be automatically processed during the creation of the PDF file and the signing (Universign) of the PDFs.
The certification service (once the PDF is signed which concludes the uninterrupted process) stores the signed PDF files on the server (Amazon Glacier).