GrassrootsPay is built with bank-grade security to protect your club's financial data and member payments.
All data is encrypted in transit (TLS 1.3) and at rest (AES-256) using the same standards as major banks.
We never store card details. All payment processing is handled by Stripe, a PCI DSS Level 1 certified processor.
Full compliance with UK GDPR and Data Protection Act 2018. Your members' data is protected by law.
All data is stored in industry standard AWS data centres.
When a member makes a payment, their card details are sent directly to Stripe (our payment processor) using end-to-end encryption. GrassrootsPay never has access to the full card number or CVV.
Stripe processes billions of pounds for companies like Amazon, Google, and Shopify. They maintain:
Advanced machine learning models analyze every transaction for potential fraud, protecting both your club and your members from unauthorized payments.
We comply with all UK GDPR and Data Protection Act requirements:
As a payment facilitator, we comply with UK financial regulations:
GrassrootsPay is hosted on enterprise-grade cloud infrastructure.
Your data is automatically backed up every 24 hours with point-in-time recovery available. In the unlikely event of a disaster, we can restore your data within hours.
24/7 automated monitoring alerts our team to any issues. We have a documented incident response plan and will notify affected users within 24 hours of any security incident.
If you have specific security questions, please contact our security team.
Contact Security Team