Skip to main content

Trust centre

About Vouchsafe's certifications, audits and compliance status, with evidence.

Written by Jaye Hackett

Major certifications

Scheme

Awarding body

Audited topics

Next audit due

UK DVS trust framework

Kantara Initiative

  • Inclusivity, accessibility and service design

  • Business probity

  • Information management

  • Information security

  • Risk management

  • Encryption and cryptography

  • Fraud management

  • Responding to incidents

  • Privacy and data protection rules

  • Using biometrics in your service

Jan 2027

ISO/IEC 27001:2022

NQA

  • Information security governance

  • Risk assessment and treatment

  • Access control and identity management

  • Asset and information protection

  • Secure development and operations

  • Supplier security management

  • Incident management

  • Business continuity and resilience

  • Continuous monitoring and improvement

Sep 2027

Cyber Essentials Plus

Kit365

  • Firewalls

  • Secure configuration

  • Security update management

  • User access control

  • Malware protection

Dec 2026

PASS 2:2020

ACCS

  • Identity document validation technology

  • Process of document checking

  • Data extraction

  • Dealing with fraud or attempted fraud

  • Training and data protection

  • Reports to accredited providers

June 2027

See our:

Also available on request:

  • ISO 27001 certificate

  • Cyber Essentials Plus certificate

Information security

Vouchsafe operates a formal information security management system, which is audited as part of our ISO 27001 certification.

Our foundational technical controls are tested annually as part of Cyber Essentials Plus.

We run an external penetration test of the Vouchsafe platform every year with the CREST-approved OnSecurity.

These efforts are supported by regular internal management reviews, internal audits and game days.

We support responsible disclosure and monitor [email protected].

Available on request:

  • key policy documents from our ISMS

  • executive summary and attestation of the latest penetration test

Data protection and privacy

Vouchsafe is audited against UK GDPR principles as part of our DVS trust framework

certification.

Our normal data storage location is the UK, in the AWS eu-west-2 (London) region.

We normally keep end user data for as long as you are a customer, or until you instruct us to delete it.

We guide customers to use Vouchsafe in a way that meets GDPR rules.

See our:

Customers on our Full plan may sign an executed version of our DPA, which takes precedence over the standard version.

How Vouchsafe uses and protects fraud intelligence

Vouchsafe works by pooling fraud reports and data between customers.

We:

  • accept reports from customers

  • use algorithms to detect patterns that are associated with synthetic or stolen identities, as well as organised fraud rings

We are an independent controller for this data, and use it to make the platform better at detecting fraud.

We use classic machine learning techniques to automate fraud detection but do not currently use any generative AI.

Under DVS trust framework rules, we are not allowed to:

  • profile users for third-party marketing

  • make aggregate data sets that could reveal sensitive information about users

We preserve individual privacy through data minimisation. It is not possible for anyone to search or view the entire Vouchsafe database. Instead, customers search the platform for a specific end user, which we then monitor.

Submit an access request

To request certificates and policies, contact:

Did this answer your question?