Security & Compliance

Security is fundamental to Parked Funds. We're built on Stripe, one of the world's most trusted payment platforms, and we follow industry best practices to keep your data and your customers' payments secure.

Built on Stripe

Parked Funds is built on top of Stripe, a PCI DSS Level 1 certified payment processor. This means:

  • PCI DSS compliance: Stripe is certified as a PCI DSS Level 1 Service Provider, the highest level of certification available. This means Stripe handles all card data in compliance with the Payment Card Industry Data Security Standard.
  • No card data storage: Parked Funds never stores or processes card numbers directly. All card data is handled by Stripe's secure infrastructure.
  • Secure payment links: Payment links use Stripe Checkout, which provides a secure, PCI-compliant payment experience for your customers.

Data Security

We take data security seriously:

  • Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
  • Encryption at rest: Sensitive data stored in our databases is encrypted at rest.
  • Secure authentication: User accounts are protected with secure password hashing and optional two-factor authentication.
  • Regular security updates: We keep all software dependencies up to date with the latest security patches.

Your Stripe Account

When you connect your Stripe account to Parked Funds:

  • You control your funds: All payments go directly to your Stripe account. Parked Funds never touches your money. We only facilitate the payment workflow.
  • Stripe Connect: We use Stripe Connect to securely link your Stripe account. This is the same technology used by platforms like Shopify and Lyft to connect merchant accounts.
  • Direct integration option: For businesses with their own Stripe account, you can use direct integration mode, where Parked Funds uses your Stripe API keys directly.

Privacy & Data Protection

We're committed to protecting your privacy and your customers' data:

  • Minimal data collection: We only collect the data necessary to provide the service. We don't sell your data to third parties.
  • Data retention: We retain data only as long as necessary to provide the service and comply with legal obligations.
  • Data access controls: Access to customer data is restricted to authorized personnel only, and all access is logged and monitored.
  • GDPR compliance: We follow GDPR principles for data protection, including the right to access, rectify, and delete personal data.

Compliance & Certifications

Parked Funds operates in compliance with:

  • PCI DSS: Through our use of Stripe, all payment processing is PCI DSS compliant.
  • New Zealand Privacy Act: We comply with the New Zealand Privacy Act 2020 and handle personal information in accordance with its principles.
  • GDPR: We follow GDPR principles for data protection, even though we primarily serve New Zealand businesses.

Security Best Practices

We follow industry best practices for security:

  • Regular security audits: We regularly review our code and infrastructure for security vulnerabilities.
  • Dependency scanning: We scan all software dependencies for known security vulnerabilities.
  • Secure development: Our development process includes security reviews and testing.
  • Incident response: We have procedures in place to respond quickly to any security incidents.

Reporting Security Issues

If you discover a security vulnerability, please report it to us responsibly:

  • Email: [email protected]
  • Response time: We aim to respond to security reports within 48 hours.
  • Responsible disclosure: We ask that you give us reasonable time to fix issues before disclosing them publicly.

Questions about security?

If you have questions about our security practices or compliance, get in touch.

Contact us

Security FAQs

Is Parked Funds PCI DSS compliant?

Yes. Parked Funds is built on Stripe, which is PCI DSS Level 1 certified. All card data is handled by Stripe's secure infrastructure, and Parked Funds never stores or processes card numbers directly.

Where is my data stored?

Parked Funds data is stored on secure servers. We use industry-standard encryption for data in transit and at rest. Payment data is handled by Stripe, which stores data in compliance with PCI DSS requirements.

Who has access to my payment data?

Only you and authorized personnel within your organization have access to your payment data through the Parked Funds dashboard. Parked Funds staff do not have access to your payment data unless you explicitly grant it for support purposes.

What happens if there's a security breach?

We have incident response procedures in place to respond quickly to any security incidents. If a breach occurs that affects your data, we will notify you as soon as possible and take immediate steps to contain and remediate the issue.