Security Requirements#
GoCardless provides two features for accessing bank account details: Encrypted Bank Details Access and Transfer Bank Accounts. Both features involve handling sensitive financial data and require both GoCardless and you (the partner or merchant) to meet specific security standards.
Responsibilities#
GoCardless uses industry-standard encryption for the storage and transmission of sensitive bank account data. Technical controls are in place to protect data in transit. Access to this data is restricted to authorised users only, with audit logs maintained for all access to the Transfer Bank Accounts and Encrypted Bank Details features. GoCardless maintains incident detection and response procedures, provides developer documentation for key management, and has backup and recovery procedures in place.
You must implement access controls for all systems that manage key material. You are responsible for key lifecycle management, including creation, storage, rotation, revocation, and disposal. RSA keys must be generated at a minimum of 2048-bit with SHA256. Keys must be rotated at least annually. You must use industry-standard encryption for any transmission and storage of sensitive data on your side, and maintain backup procedures for all key material.
Key Requirements Summary#
| Requirement | Detail |
|---|---|
| RSA key size | Minimum 2048-bit |
| Signature algorithm | SHA256 |
| Key rotation frequency | At least annually |
| Encryption standard | Industry-standard (e.g. AES-256 for storage, TLS 1.2+ for transit) |