Skip to main content
Vindicia has security and compliance built into every layer of its platform architecture. At the core of its platform, Vindicia is built to keep data secure and compliant – two aspects of business that are instrumental for meeting subscription business needs and enabling growth. Vindicia merchants benefit from the cloud data center and network architecture built to meet the requirements of the most security-sensitive organizations and most strict compliance frameworks. The crucial policies, architecture, and operational processes that merchants must implement in their payments and billing environments to comply with global data and security measures are automatically adopted with the Vindicia subscription management platform. The holistic software-based security tools that are part of the Vindicia platform monitor and protect the flow of information in and out of your cloud resources.

​
Security Support

Vindicia has created far-reaching measures to safeguard personal subscriber information against loss, theft, unauthorized access, use, and modification. These measures provide the appropriate level of security for specific risks surrounding processing information. Our platform adheres to the following security standards:
  • SOC 1 type 2, SOC 2 Type 2 certified
  • SOX compliant
  • PCI-DSS Level 1 compliant
  • ISO 27001
  • EU GDPR and SCC committed
  • California CCPA committed
  • Brazilian LGPD committed
The following key applications and services provide advanced internet security technology to the Vindicia platform:
  • Encryption
  • Digital Certificate
  • Security Development Lifecycle
  • Access Control of Customer Data
  • Audits and Accountability
  • Architecture
  • Media Protection
  • System and Communication Protection
  • Multi-level System and Data Recovery Schemes
  • Operation-Level Security Control (for example: Multiple System Controls and certifications or Vulnerability Management and Configuration Management)
  • Vindicia IDP providing Multi-Factor Authentication for Subscribe users, complex and unique password requirements

​
PCI DSS Compliance

PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards created by the credit card industry to protect payment systems from data breaches. Vindicia holds PCI-DSS (Payment Card Industry Data Security Standard) Level 1 service provider certification, which was achieved through continuous investment in rigorous controls and processes and thorough completion of SOC 1 type 2 and SOC 2 Type 2 compliance certification. To become a Level 1 PCI-certified Service Provider, Vindicia met the following requirements and in turn, provides maximum security and compliance benefits to all subscription business merchants:
  • Install and maintain a firewall configuration to protect cardholder data
  • Do not use vendor-supplied defaults for system passwords and other security parameters
  • Protect stored cardholder data
  • Encrypt transmission of cardholder data across open, public networks
  • protect all systems against malware and regularly update antivirus software or programs
  • Develop and maintain secure systems and applications
  • Restrict access to cardholder data by business need to know
  • Identify and authenticate access to system components
  • Restrict physical access to cardholder data
  • Track and monitor all access to network resources and cardholder data
  • Regularly test security systems and processes
  • Maintain a policy that addresses information security for all personnel

​
GDPR Compliance

As part of helping our merchants protect their data, Vindicia is fully committed to maintaining its GDPR compliance, thereby adding protection to merchants’ subscription strategy, design, and overall data privacy. Vindicia helps our merchants understand, and where applicable, comply with the General Data Protection Regulation (GDPR), which is designed to give European Union (EU) citizens more control over their data and seeks to unify several existing privacy and security laws under one comprehensive law. Vindicia allows merchant administrators to perform GDPR erasure on their own. Note: The GDPR not only applies to organizations located within the EU, but it also applies to all companies processing and holding the personal data of data subjects residing in the EU, regardless of the company’s location. Beyond replication, backup, and disaster recovery planning, encryption in both transit and at rest, advanced threat detection, and common controls, Vindicia helps subscription businesses utilize and benefit from the following measures as part of maintaining GDPR compliance:
  • Security and certifications
  • International data transfers
  • Prime data location and portability in the United States
  • Individual privacy rights and consent
  • Data subject rights
  • Choice and consent
For more details, feel free to contact compliance@vindicia.com