Every transaction is encrypted, every certification is independently audited, and every employee is held to the same standards we ask of ourselves.
Trust here isn’t assumed. It’s earned continuously.
Every transaction is encrypted, every certification is independently audited, and every employee is held to the same standards we ask of ourselves.
Trust here isn’t assumed. It’s earned continuously.
Independently audited security
MoonPay has obtained SOC2 Type 2, ISO/IEC 27001:2022, 27701:2019, and 27018:2019 certification, is PCI DSS compliant, and holds Cybersecurity Maturity Model Certification.
35M+
Verified accounts protected.
AES-256
Rock-solid encryption across the board.
Data sent to or from MoonPay is rigorously protected using TLS 1.2 or higher for secure transit and AES-256 encryption with automated key management for data at rest. To ensure end-to-end integrity, we require our vendors to maintain enterprise-grade security postures backed by SOC, ISO, PCI DSS, or equivalent audited controls. Your payment details are handled under strict PCI DSS compliance, the same standard used by global banks, while personal data is processed in strict accordance with GDPR, ensuring your information is only ever used in ways you’ve explicitly agreed to.
MoonPay employees use company-managed devices and are required to use single sign-on and multi-factor authentication for every third-party tool. All employees undergo background checks before joining and receive security training from their first day.
Every code change is reviewed by a second engineer and scanned for insecure patterns before it’s shipped. Dependencies are updated automatically, and our security team works alongside engineering throughout development. Engineers receive regular security training, so the entire team, not just the security team, stays alert to risk.
Crypto scams are common and move fast. Learn the warning signs and what to do if you suspect fraud before you send any money.
We run a public bug bounty programme on HackerOne and reward valid, responsibly disclosed vulnerabilities. If you’ve identified a security issue, we want to hear from you first.
Our Trust Centre provides the certification, audit, and sub-processor detail your compliance team needs for due diligence.
View Trust Centre
