# Securing a Payment API

At Dwolla, security is at the forefront of everything we do.

## Shielded From the Adversaries

We understand that trust is paramount in the financial industry, so we've implemented sophisticated security practices to help safeguard your data and give you peace of mind. Dwolla maintains a SOC 2 type 2 report focused on the Security trust principle and our Information Security (InfoSec) team is dedicated to protecting our data from potential adversaries using a defensive strategy against prospective threats. We believe security work is never done, so we are always striving to improve our practices.

Our commitment to security is built on a multi-layered approach that encompasses our technology, our people and our culture.

### Security in Action

1. **Ongoing Education**  
   All Dwolla employees are required to complete annual Information Security and Privacy training, and our Engineering and InfoSec teams also receive advanced Information Security training.

2. **Community Conscious**  
   Dwolla uses tokenization to decrease the value of financial transaction messages, as sensitive information is replaced with a token and unique identifiers.

3. **Endpoint Security**  
   Dwolla secures all devices with access to its resources by monitoring them with known-good configurations and multiple security agents.

4. **Continuous Monitoring**  
   Dwolla's platform is monitored 24/7/365 using a combination of internal and external tools and services. This includes monitoring Dwolla Platform API endpoints, infrastructure, service and event monitoring.

5. **Border Protection**  
   Dwolla uses a combination of AWS virtual private clouds (VPCs) and an Enterprise partnership with Cloudflare to provide a secure and highly available platform edge.

6. **Vulnerability Management**  
   Dwolla performs penetration tests on a bi-annual basis and maintains relationships with multiple external providers of security assessment services.

For a deeper dive into our comprehensive security measures, please visit our [dedicated security website](https://trust.dwolla.com/).

> “At Dwolla, we are continuously testing because we should know adversarial techniques. Our Information Security Program focuses on the latest technologies and understanding how they are being exploited.”  
> — Skyler Nesheim, Dwolla’s Chief Technology Officer and Chief Information Security Officer

### Talk to a Payments Expert

## Security built for high-stakes payment operations

Dwolla's infrastructure is designed around the security and compliance requirements of enterprise payment operations. SOC 2 Type 2 certified, with tokenization, encryption, and access controls built in.

### Key Benefits

#### What changes for your team

Outcomes that matter to the teams responsible for payments, product delivery, and operations.

1. **SOC 2 Type 2 Certified**  
   Dwolla undergoes annual SOC 2 Type 2 audits covering security, availability, and confidentiality. Your compliance team gets the documentation they need.

2. **Data Encryption**  
   Sensitive data is encrypted in transit and at rest. Bank account information is tokenized so your systems do not need to store raw account numbers.

3. **Access Controls**  
   Role-based access helps your team control who sees what. API keys, OAuth tokens, and dashboard roles provide layered security.

4. **Regulated Partner Network**  
   Dwolla operates within a regulated framework through financial institution partners. Your payments flow through established, compliant infrastructure.

### How It Works

#### From integration to production

1. **Review Dwolla's security posture**  
   Our security documentation, SOC 2 reports, and compliance certifications are available for your team's review during the evaluation process.

2. **Configure access and controls**  
   Set up API keys, OAuth scopes, dashboard roles, and webhook signatures to match your organization's security policies.

3. **Monitor and audit**  
   Full audit trails, webhook logs, and transaction history give your security and compliance teams the visibility they require.

## Built for Scale

### Trusted by platforms and enterprises

SOC 2  
Type 2 certified  
Encrypted  
In transit + at rest  
Tokenized  
Bank account data  
16+  
Years of security ops

### Security your compliance team can trust

See how Dwolla's security infrastructure meets enterprise requirements for high-volume payment operations.