# Security Requirements

Source: https://docs.gocardless.com/docs/api-reference/security-requirements

# Security Requirements

GoCardless provides two features for accessing bank account details: **Encrypted Bank Details Access** and **Transfer Bank Accounts**. Both features involve handling sensitive financial data and require both GoCardless and you (the partner or merchant) to meet specific security standards.

## Responsibilities

  
#### GoCardless Responsibilities

GoCardless uses industry-standard encryption for the storage and transmission of sensitive bank
    account data. Technical controls are in place to protect data in transit. Access to this data is
    restricted to authorised users only, with audit logs maintained for all access to the Transfer
    Bank Accounts and Encrypted Bank Details features. GoCardless maintains incident detection and
    response procedures, provides developer documentation for key management, and has backup and
    recovery procedures in place.

  
#### Your Responsibilities

You must implement access controls for all systems that manage key material. You are responsible
    for key lifecycle management, including creation, storage, rotation, revocation, and disposal.
    RSA keys must be generated at a minimum of 2048-bit with SHA256. Keys must be rotated at least
    annually. You must use industry-standard encryption for any transmission and storage of
    sensitive data on your side, and maintain backup procedures for all key material.

## Key Requirements Summary

| Requirement            | Detail                                                             |
| ---------------------- | ------------------------------------------------------------------ |
| RSA key size           | Minimum 2048-bit                                                   |
| Signature algorithm    | SHA256                                                             |
| Key rotation frequency | At least annually                                                  |
| Encryption standard    | Industry-standard (e.g. AES-256 for storage, TLS 1.2+ for transit) |

## What's next

  
#### [Certificate Policy](/docs/api-reference/certificate-policy)

Learn about GoCardless's TLS certificate policy and how it affects your integration.

  
#### [Client Libraries](/docs/developer-resources/client-libraries)

Use an official GoCardless client library to simplify API integration.