Every transaction is encrypted, every certification is independently audited, and every employee is held to the same standards we ask of ourselves.
Trust here isn’t assumed. It’s earned, day in, day out.
Every transaction is encrypted, every certification is independently audited, and every employee is held to the same standards we ask of ourselves.
Trust here isn’t assumed. It’s earned, day in, day out.
Independently audited security
MoonPay has obtained SOC2 Type 2, ISO/IEC 27001:2022, 27701:2019, and 27018:2019 certification, is PCI DSS compliant, and holds Cybersecurity Maturity Model Certification.
35M+
Verified accounts protected.
AES-256
Rock-solid encryption, every step of the way.
Data sent to or from MoonPay is rigorously protected using TLS 1.2 or higher for secure transit and AES-256 encryption with automated key management for data at rest. To ensure end-to-end integrity, we require our vendors to maintain enterprise-grade security postures backed by SOC, ISO, PCI DSS, or equivalent audited controls. Your payment details are handled under strict PCI DSS compliance, the same standard used by major banks worldwide, while personal data is processed in strict accordance with GDPR, ensuring your information is only ever used in ways you’ve clearly agreed to.
MoonPay staff use company-managed devices and must use single sign-on and multi-factor authentication for every third-party tool. All staff undergo background checks before joining and receive security training from their first day.
Every code change is reviewed by another engineer and scanned for insecure patterns before it ships. Dependencies are updated automatically, and our security team works alongside engineering throughout development. Engineers get regular security training, so the whole team – not just the security team – stays alert to risk.
Crypto scams are common and move quickly. Learn the warning signs and what to do if you suspect fraud before you send any funds.
We run a public bug bounty program on HackerOne and reward valid, responsibly disclosed vulnerabilities. If you’ve found a security issue, we’d like you to let us know first.
Our Trust Centre provides the certification, audit, and sub-processor detail your compliance team needs for due diligence.
View Trust Centre
