Your data and your money, protected
SideUp looks after information about your people and the money they spend on their benefits. Here's how we protect both, in plain English.
Data protection
We handle personal data in line with applicable US privacy laws, including the California Consumer Privacy Act (CCPA), and only collect what we need to run your benefits.
How we protect data →Issued by Celtic BankSecure payments
SideUp cards are powered by Stripe and issued by Celtic Bank, with funds held at Stripe's bank partners, Members FDIC.
How payments work →Built inPlatform security
Access controls, encryption and careful handling of card details keep your company's account and your team's information safe.
How we secure SideUp →Built around US privacy laws
We process personal data in line with applicable US privacy laws, including the California Consumer Privacy Act (CCPA). That means being clear about what we use, why we use it and how long we keep it.
Only what we need
We collect the information needed to run your benefits, pay providers and keep the right records, and nothing more.
Used for a clear purpose
Data is used to deliver the SideUp service, support your team and meet our legal obligations. We never sell personal data.
Kept only as long as needed
We keep personal data for as long as we need it for these purposes or the law requires, then delete or anonymize it.
YOUR RIGHTS
You're in control of your data
To exercise any of these rights, email our Privacy & Data Protection Lead. Depending on where you live, you may also be able to contact your state attorney general or privacy regulator.
privacy@sideup.comSecure card payments you can rely on
Every SideUp card is powered by Stripe and issued by Celtic Bank, so your benefit budgets are handled through established US banking and payments partners.
Cards powered by Stripe and issued by Celtic Bank
Funds held at Stripe's bank partners, Members FDIC
Spending limited to the budgets and categories your company sets
ProtectedIssued by Celtic Bank
SideUp Visa® Commercial cards are powered by Stripe and issued by Celtic Bank. Stripe Issuing balances are provided in the US by Stripe Payments Company, licensed money transmitter, with funds held at Stripe's bank partners, Members FDIC.
Security built into everyday use
Good security isn't one big feature. It's lots of small, sensible protections working together.
01
Encrypted connections
Data traveling between your browser, our app and our systems is encrypted.
02
The right access for the right people
Admins only see what they need, and employees only see their own budgets and spending.
03
Card details stay with our issuer
Full card numbers are handled by our card issuing partners, rather than stored on SideUp's own systems.
04
Trusted vendors
We work with established providers and expect them to protect data to the same standard we do.
The controls behind the promise
A full view of the safeguards we have in place, grouped by where they protect you.
Infrastructure security
14 controls✓Unique production database authentication
✓Encryption key access restricted
✓Unique account authentication enforced
✓Production application access restricted
✓Production operating system access restricted
✓Production network access restricted
✓Intrusion detection in use
✓Log management in use
✓Infrastructure performance monitored
✓Network segmentation in place
✓Network firewalls in use
✓Network firewalls regularly reviewed
✓Network and system hardening standards
✓Service infrastructure maintained
Internal security procedures
14 controls✓Business continuity and disaster recovery plans
✓Configuration management system
✓Change management procedures enforced
✓Production deployment access restricted
✓Defined development lifecycle
✓Customer support channels available
✓Security commitments shared with customers
✓Incident response plan in place
✓Risk management program
✓Regular risk assessments
✓Vendor management program
✓Cybersecurity insurance maintained
✓Security policies set and reviewed
✓Clear security roles and responsibilities
Organizational security
12 controls✓Asset disposal procedures
✓Production inventory maintained
✓Portable media encrypted
✓Anti-malware technology in use
✓Acceptable use policy acknowledged
✓Security awareness training
✓Confidentiality agreements for employees
✓Confidentiality agreements for contractors
✓Regular performance reviews
✓Code of conduct acknowledged and enforced
✓Background checks
✓Password policy enforced
Product security
7 controls✓Data encryption in use
✓Control self-assessments
✓Vulnerabilities scanned and fixed
✓Role-based access for admins and employees
✓Card details held by our card issuing partners
✓Secure sign-in to the app
✓Logging of key admin actions
Data & privacy
7 controls✓Data retention procedures
✓Customer data deleted when they leave
✓Data classification policy
✓Published privacy policy
✓Named Privacy & Data Protection Lead
✓Process for privacy requests
✓Personal data never sold
We review our controls regularly and are working toward formal security certification.
Something doesn't look right?
Tell us straight away. The sooner we know, the sooner we can help.
Lost card or a payment you don't recognise
Contact our Customer Success team and we'll help you secure your card and look into the payment.
help@sideup.comA question or concern about your data
Contact our Privacy & Data Protection Lead about how your data is used, or to exercise your rights.
privacy@sideup.comA possible security issue
Found something that could affect the security of SideUp? Let us know, with as much detail as you can, and we'll investigate.
Report an issueFrequently Asked Questions
Common questions about data protection and security at SideUp.
Does SideUp comply with US privacy laws?
We process personal data in line with applicable US privacy laws, including the California Consumer Privacy Act (CCPA). We collect only what we need to run your benefits, use it for clear purposes and keep it only as long as we need to.
Does SideUp sell personal data?
No. We never sell personal data.
Who issues the SideUp card?
SideUp Visa Commercial cards are powered by Stripe and issued by Celtic Bank. You'll find the full details in the Secure payments section above.
Does SideUp store full card numbers?
No. Full card details are handled by our card issuing partners, rather than stored on SideUp's own systems.
Does SideUp hold security certifications?
We're working toward formal security certifications. In the meantime, our security controls are listed on this page, and we're happy to answer your questions as part of your procurement process.
How do I make a privacy request?
Email privacy@sideup.com. Depending on where you live, you may also be able to contact your state attorney general or privacy regulator.
What should I do if my card is lost or stolen?
Contact help@sideup.com right away, and our Customer Success team will help you secure your card.