Payment Security and Compliance | Dwolla

Securing a Payment API

At Dwolla, security is at the forefront of everything we do.

Shielded From the Adversaries

We understand that trust is paramount in the financial industry, so we've implemented sophisticated security practices to help safeguard your data and give you peace of mind. Dwolla maintains a SOC 2 type 2 report focused on the Security trust principle and our Information Security (InfoSec) team is dedicated to protecting our data from potential adversaries using a defensive strategy against prospective threats. We believe security work is never done, so we are always striving to improve our practices.

Our commitment to security is built on a multi-layered approach that encompasses our technology, our people and our culture.

Security in Action

  1. Ongoing Education
    All Dwolla employees are required to complete annual Information Security and Privacy training, and our Engineering and InfoSec teams also receive advanced Information Security training.

  2. Community Conscious
    Dwolla uses tokenization to decrease the value of financial transaction messages, as sensitive information is replaced with a token and unique identifiers.

  3. Endpoint Security
    Dwolla secures all devices with access to its resources by monitoring them with known-good configurations and multiple security agents.

  4. Continuous Monitoring
    Dwolla's platform is monitored 24/7/365 using a combination of internal and external tools and services. This includes monitoring Dwolla Platform API endpoints, infrastructure, service and event monitoring.

  5. Border Protection
    Dwolla uses a combination of AWS virtual private clouds (VPCs) and an Enterprise partnership with Cloudflare to provide a secure and highly available platform edge.

  6. Vulnerability Management
    Dwolla performs penetration tests on a bi-annual basis and maintains relationships with multiple external providers of security assessment services.

For a deeper dive into our comprehensive security measures, please visit our dedicated security website.

“At Dwolla, we are continuously testing because we should know adversarial techniques. Our Information Security Program focuses on the latest technologies and understanding how they are being exploited.”
— Skyler Nesheim, Dwolla’s Chief Technology Officer and Chief Information Security Officer

Talk to a Payments Expert

Security built for high-stakes payment operations

Dwolla's infrastructure is designed around the security and compliance requirements of enterprise payment operations. SOC 2 Type 2 certified, with tokenization, encryption, and access controls built in.

Key Benefits

What changes for your team

Outcomes that matter to the teams responsible for payments, product delivery, and operations.

  1. SOC 2 Type 2 Certified
    Dwolla undergoes annual SOC 2 Type 2 audits covering security, availability, and confidentiality. Your compliance team gets the documentation they need.

  2. Data Encryption
    Sensitive data is encrypted in transit and at rest. Bank account information is tokenized so your systems do not need to store raw account numbers.

  3. Access Controls
    Role-based access helps your team control who sees what. API keys, OAuth tokens, and dashboard roles provide layered security.

  4. Regulated Partner Network
    Dwolla operates within a regulated framework through financial institution partners. Your payments flow through established, compliant infrastructure.

How It Works

From integration to production

  1. Review Dwolla's security posture
    Our security documentation, SOC 2 reports, and compliance certifications are available for your team's review during the evaluation process.

  2. Configure access and controls
    Set up API keys, OAuth scopes, dashboard roles, and webhook signatures to match your organization's security policies.

  3. Monitor and audit
    Full audit trails, webhook logs, and transaction history give your security and compliance teams the visibility they require.

Built for Scale

Trusted by platforms and enterprises

SOC 2
Type 2 certified
Encrypted
In transit + at rest
Tokenized
Bank account data
16+
Years of security ops

Security your compliance team can trust

See how Dwolla's security infrastructure meets enterprise requirements for high-volume payment operations.