Policies
A Dedicated Team
Pupil Wallet’s team of developers constantly monitor and maintain the system’s infrastructure. In the unlikely event customers experience issues with their system, Pupil Wallet’s 24/7 support staff are always on standby.
External Auditing & PCI DSS Compliance
Our secure payment system, Square, has been audited by a PCI-certified auditor and is certified to PCI Service Provider Level 1. This is the most stringent level of certification available in the payments industry. To achieve this, Square uses the best-in-class security tools and practices to maintain a high level of security.
ISO & SOC Compliant
Pupil wallet data is safeguarded by Google firebase which is certified under major privacy and security standards and is both ISO and SOC complaint. Firebase services have successfully completed the ISO 27001 and SOC 1, SOC 2, SOC 3 evaluation process, and some have also completed the ISO 27017 and ISO 27018 certification process. For more information regarding Firebase compliancy, please visit: https://firebase.google.com/support/privacy
Encryption of Sensitive Data and Communication
All information is encrypted at rest with AES-256. Decryption keys are stored on separate machines. None of Square’s internal servers and daemons can obtain plaintext card numbers but can request that cards are sent to a service provider on a static whitelist. Square’s infrastructure for storing, decrypting, and transmitting card numbers runs in a separate hosting environment and doesn’t share any credentials with Square’s primary services.
GDPR Compliant
All Pupil Wallet services are governed by General Data Protection Regulation. We only manage data in agreement of the data controller. Our services are routinely monitored and improved to meet safeguards around data handling.
FCA Compliant
Pupil Wallets secure payment system, Square, is regulated by the U.K. Financial Conduct Authority. Squareup Europe Company number:08957689 FCA reference number:900846.