Your data and your money, protected
SideUp looks after information about your people and the money they spend on their benefits. Here's how we protect both, in plain English.
Data protection
We handle personal data in line with UK GDPR and the Data Protection Act 2018, and only collect what we need to run your benefits.
How we protect data →FCA-authorised partnerSecure payments
SideUp cards are issued by an authorised payments partner, regulated by the Financial Conduct Authority.
How payments work →Built inPlatform security
Access controls, encryption and careful handling of card details keep your company's account and your team's information safe.
How we secure SideUp →Built around UK GDPR
We process personal data in line with UK GDPR and the Data Protection Act 2018. That means being clear about what we use, why we use it and how long we keep it.
Only what we need
We collect the information needed to run your benefits, pay providers and keep the right records, and nothing more.
Used for a clear purpose
Data is used to deliver the SideUp service, support your team and meet our legal obligations. We never sell personal data.
Kept only as long as needed
We keep personal data for as long as we need it for these purposes or the law requires, then delete or anonymise it.
YOUR RIGHTS
You're in control of your data
To exercise any of these rights, email our Privacy & Data Protection Lead, Emma Oliveira. You also have the right to complain to the Information Commissioner's Office (ICO).
privacy@sideup.comRegulated card payments you can rely on
Every SideUp card is issued by an authorised payments partner, so your benefits budgets are handled within the UK's regulated payments framework.
Issued by an electronic money institution authorised by the Financial Conduct Authority
Customer funds safeguarded under FCA rules
Spending limited to the budgets and categories your company sets
ProtectedIssued by Stripe Payments UK Limited
SideUp Visa® cards are issued by Stripe Payments UK Limited, an electronic money institution authorised by the Financial Conduct Authority (firm reference number 900461) for the issuing of electronic money and the provision of payment services. Cards are issued under the Visa card scheme pursuant to a licence from Visa Europe Limited.
Security built into everyday use
Good security isn't one big feature. It's lots of small, sensible protections working together.
01
Encrypted connections
Data travelling between your browser, our app and our systems is encrypted.
02
The right access for the right people
Admins only see what they need, and employees only see their own budgets and spending.
03
Card details stay with our issuer
Full card numbers are handled by our authorised card issuer, rather than stored on SideUp's own systems.
04
Trusted suppliers
We work with established providers and expect them to protect data to the same standard we do.
The controls behind the promise
A full view of the safeguards we have in place, grouped by where they protect you.
Infrastructure security
14 controls✓Unique production database authentication
✓Encryption key access restricted
✓Unique account authentication enforced
✓Production application access restricted
✓Production operating system access restricted
✓Production network access restricted
✓Intrusion detection in use
✓Log management in use
✓Infrastructure performance monitored
✓Network segmentation in place
✓Network firewalls in use
✓Network firewalls regularly reviewed
✓Network and system hardening standards
✓Service infrastructure maintained
Internal security procedures
14 controls✓Business continuity and disaster recovery plans
✓Configuration management system
✓Change management procedures enforced
✓Production deployment access restricted
✓Defined development lifecycle
✓Customer support channels available
✓Security commitments shared with customers
✓Incident response plan in place
✓Risk management programme
✓Regular risk assessments
✓Supplier management programme
✓Cyber security insurance maintained
✓Security policies set and reviewed
✓Clear security roles and responsibilities
Organisational security
12 controls✓Asset disposal procedures
✓Production inventory maintained
✓Portable media encrypted
✓Anti-malware technology in use
✓Acceptable use policy acknowledged
✓Security awareness training
✓Confidentiality agreements for employees
✓Confidentiality agreements for contractors
✓Regular performance reviews
✓Code of conduct acknowledged and enforced
✓Background checks
✓Password policy enforced
Product security
7 controls✓Data encryption in use
✓Control self-assessments
✓Vulnerabilities scanned and fixed
✓Role-based access for admins and employees
✓Card details held by our authorised issuer
✓Secure sign-in to the app
✓Logging of key admin actions
Data & privacy
7 controls✓Data retention procedures
✓Customer data deleted when they leave
✓Data classification policy
✓Published privacy policy
✓Named Privacy & Data Protection Lead
✓Process for data subject requests
✓Personal data never sold
We review our controls regularly and are working towards formal security certification.
Something doesn't look right?
Tell us straight away. The sooner we know, the sooner we can help.
Lost card or a payment you don't recognise
Contact our Customer Success team and we'll help you secure your card and look into the payment.
help@sideup.comA question or concern about your data
Contact our Privacy & Data Protection Lead about how your data is used, or to exercise your rights.
privacy@sideup.comA possible security issue
Found something that could affect the security of SideUp? Let us know, with as much detail as you can, and we'll investigate.
Report an issueFrequently Asked Questions
Common questions about data protection and security at SideUp.
Is SideUp GDPR compliant?
We process personal data in line with UK GDPR and the Data Protection Act 2018. We collect only what we need to run your benefits, use it for clear purposes and keep it only as long as we need to.
Does SideUp sell personal data?
No. We never sell personal data.
Who issues the SideUp card?
SideUp cards are issued by an authorised payments partner, an electronic money institution regulated by the Financial Conduct Authority. You'll find the full details in the Secure payments section above.
Does SideUp store full card numbers?
No. Full card details are handled by our authorised card issuer, rather than stored on SideUp's own systems.
Does SideUp hold security certifications?
We're working towards formal security certifications. In the meantime, our security controls are listed on this page, and we're happy to answer your questions as part of your procurement process.
How do I make a data protection request?
Email privacy@sideup.com. You also have the right to complain to the Information Commissioner's Office (ICO).
What should I do if my card is lost or stolen?
Contact help@sideup.com straight away, and our Customer Success team will help you secure your card.