This page is intended to provide a general overview of our approach to security. It does not disclose confidential technical configurations, internal security procedures or information that could reasonably compromise the security of Wetapo, our Customers, End Users or other organisations.
1. Our approach to security
Wetapo approaches security as an ongoing process rather than a single technical feature.
Our objective is to identify and manage technology and information-security risks throughout the design, development, operation and evolution of our services.
Security considerations may therefore form part of:
- system and product design;
- software development;
- infrastructure management;
- access management;
- data handling;
- integration with external systems;
- operational processes;
- risk management;
- incident management;
- business continuity;
- and relationships with relevant service providers.
The nature and level of security measures applied may vary according to the sensitivity of the information, the nature of the relevant system, the potential impact of an incident and other relevant risk factors.
Wetapo seeks to apply measures that are proportionate to the risks associated with the relevant technology and activity.
2. Security by design
Security considerations should form part of the design and development of Wetapo technology from an early stage.
Where appropriate, security requirements may be considered when designing:
- applications;
- payment journeys;
- APIs and integrations;
- data flows;
- access mechanisms;
- infrastructure;
- administrative functionality;
- and new product features.
The objective of this approach is to identify security considerations before functionality is introduced into a production environment rather than relying solely on controls introduced after deployment.
Changes to systems and functionality may also be reviewed from a security perspective where the nature or significance of the change makes this appropriate.
3. Information security principles
Wetapo's approach to information security is based around protecting the confidentiality, integrity and availability of information and systems.
Confidentiality
Information should be accessible only to persons, systems and organisations with an appropriate reason and authority to access it.
Integrity
Information and systems should be protected against unauthorised or inappropriate modification, destruction or manipulation.
Availability
Systems and information required to provide services should be designed and managed with appropriate consideration for reliability, continuity and recovery.
These principles are considered together because effective security requires more than simply preventing unauthorised access.
A system that protects confidentiality but cannot reliably provide necessary functionality, or information that is available but cannot be trusted to remain accurate, may still present significant operational and security risk.
4. Protection of personal and payment-related information
Wetapo recognises that payment environments may involve information that requires an appropriate level of protection.
We seek to limit the collection and use of information to what is reasonably necessary for legitimate business, technical, security, payment or legal purposes.
Where Wetapo processes personal data, that information is handled in accordance with applicable data protection requirements and our Privacy Policy.
Payment-related information may also be subject to technical, contractual or regulatory safeguards depending on the relevant service and payment flow.
Wetapo does not require End Users to provide their online banking password directly to Wetapo as part of a standard Pay by Bank authentication journey.
Bank authentication is generally performed through the environment or authentication mechanism provided or supported by the relevant bank or authorised payment service provider.
Wetapo seeks to avoid unnecessary access to sensitive information and to design data flows so that information is available only where reasonably required for the relevant purpose.
5. Access management
Access to systems and information is an important component of information security.
Wetapo seeks to apply access-management principles designed to ensure that access is provided according to legitimate business and operational requirements.
Depending on the system and level of risk, access controls may include:
- individual user identification;
- authentication requirements;
- role-based or otherwise restricted access;
- appropriate authorisation procedures;
- separation of access privileges;
- periodic review of relevant permissions;
- removal or modification of access when it is no longer required;
- and additional safeguards for sensitive or privileged access.
Access to sensitive systems should be limited to authorised persons whose responsibilities reasonably require such access.
Wetapo seeks to avoid granting broader access than is necessary for the relevant role or purpose.
6. Authentication and credentials
Authentication mechanisms are intended to reduce the risk of unauthorised access to Wetapo systems and functionality.
The authentication controls appropriate to a particular system may depend on the sensitivity of the system, type of user and potential consequences of unauthorised access.
Credentials used to access Wetapo systems should be treated as confidential and protected against disclosure or misuse.
Customers and authorised users are responsible for maintaining appropriate security over credentials issued to them and should not share credentials with unauthorised persons.
If a Customer or user knows or reasonably suspects that credentials associated with Wetapo have been compromised, they should contact Wetapo promptly.
7. Encryption and secure communication
Wetapo seeks to use appropriate methods to protect information during transmission and, where appropriate, during storage.
Encryption and secure communication mechanisms may be used according to the nature and sensitivity of the information and the relevant technical environment.
The objective is to reduce the risk that information can be intercepted, accessed or modified by unauthorised parties.
The precise technical implementation of encryption and cryptographic controls may change as technologies, security practices and risks evolve.
For security reasons, detailed cryptographic configurations are not disclosed on this public page.
8. Infrastructure and network security
Wetapo seeks to design and operate its technology with appropriate infrastructure and network-security considerations.
Security controls may be applied at different layers of the technical environment to reduce the likelihood and potential impact of unauthorised access, malicious activity, misconfiguration and other technology risks.
Depending on the relevant environment, this may include measures concerning:
- network access;
- system configuration;
- service isolation;
- infrastructure permissions;
- software updates;
- monitoring;
- logging;
- vulnerability management;
- and protection of administrative functionality.
Security measures may evolve over time as Wetapo's infrastructure, products and risk profile develop.
9. Secure software development
Security is relevant throughout the software-development lifecycle.
Wetapo seeks to incorporate appropriate security practices into the development and maintenance of its technology.
Depending on the nature of the development activity, these practices may include:
- security considerations during design;
- controlled development processes;
- source-code management;
- peer or technical review;
- dependency management;
- testing;
- change management;
- separation between development and production activities where appropriate;
- and review of security implications associated with significant changes.
Software dependencies and external components may introduce their own security risks.
Wetapo therefore seeks to consider those risks as part of the development and maintenance of its technology.
10. Change management
Changes to payment and technology systems can introduce operational and security risks if they are not appropriately managed.
Wetapo seeks to apply proportionate controls to significant changes affecting its systems and services.
Depending on the nature of a change, this may involve:
- documenting the change;
- reviewing potential impact;
- testing;
- obtaining appropriate approval;
- planning deployment;
- monitoring the result;
- and maintaining an ability to respond where a change causes unexpected consequences.
The level of review may depend on the significance, complexity and potential impact of the change.
11. Vulnerability management
Software and infrastructure can develop vulnerabilities as technology and security threats evolve.
Wetapo seeks to maintain processes for identifying, assessing and addressing vulnerabilities relevant to its systems.
Vulnerability management may involve information obtained through:
- internal technical review;
- automated security tools;
- security testing;
- software and dependency information;
- external security research;
- service providers;
- and reports submitted to Wetapo.
Identified vulnerabilities may be assessed according to factors such as their severity, exploitability, affected systems and potential impact.
Remediation priorities may therefore vary according to risk.
12. Security monitoring and detection
Preventive controls alone cannot eliminate every security risk.
Wetapo therefore seeks to maintain appropriate capabilities for identifying suspicious activity, security events and potential incidents affecting relevant systems.
Monitoring may include analysis of technical events, access activity, system behaviour, application activity and other security-relevant information.
Where unusual activity is identified, it may be investigated to determine whether further action is required.
Security monitoring is intended to support the protection of Wetapo systems, Customers, End Users and relevant information.
13. Logging and auditability
Appropriate logging can support security monitoring, troubleshooting, incident investigation and accountability.
Wetapo may maintain technical and operational records relating to relevant system activity.
Depending on the system, logs may contain information concerning:
- access;
- authentication;
- system activity;
- application events;
- errors;
- administrative actions;
- security events;
- and other technically relevant activity.
Access to security and operational logs should itself be appropriately controlled.
Log retention may vary according to operational, security, legal and regulatory requirements.
14. Security testing
Wetapo recognises the importance of testing security controls and identifying weaknesses before they can be exploited.
Depending on the maturity, nature and risk profile of the relevant systems, security assurance activities may include:
- technical security testing;
- vulnerability assessment;
- application testing;
- infrastructure review;
- configuration review;
- code review;
- and other appropriate forms of security assessment.
The nature, scope and frequency of testing may vary according to the systems involved and the risks they present.
Where vulnerabilities or weaknesses are identified, Wetapo seeks to assess their significance and prioritise remediation appropriately.
For security reasons, detailed information concerning testing methodologies, schedules or findings is not disclosed publicly.
15. Incident management
Despite reasonable security measures, no technology environment can be guaranteed to be completely immune from security incidents.
Wetapo therefore considers incident preparedness an important part of security.
Where appropriate, incident-management processes are intended to support:
- identification of potential incidents;
- assessment and classification;
- containment;
- investigation;
- mitigation;
- recovery;
- internal escalation;
- communication;
- and review following the incident.
The response to an incident will depend on its nature, severity and potential impact.
Where an incident gives rise to legal, contractual or regulatory notification obligations, the relevant notifications will be made in accordance with applicable requirements.
16. Business continuity and operational resilience
Security also involves maintaining the ability to continue or restore important services following disruption.
Wetapo seeks to consider operational resilience when designing and operating relevant technology and business processes.
Depending on the service and associated risks, resilience considerations may include:
- system availability;
- infrastructure resilience;
- backups;
- recovery arrangements;
- incident response;
- dependencies on external services;
- communication arrangements;
- and restoration of important functionality.
Business continuity and recovery arrangements may be reviewed and developed as Wetapo's services and operational requirements evolve.
The objective is not to assume that disruption can always be prevented, but to maintain an appropriate ability to respond to and recover from disruptive events.
17. Backups and recovery
Where appropriate, Wetapo may maintain backup and recovery arrangements designed to reduce the potential impact of data loss, system failure or other disruptive events.
The nature, frequency and retention of backups may depend on the relevant system, information and recovery requirements.
Access to backups should be appropriately restricted, and backup information should be protected according to its sensitivity.
Recovery arrangements may be tested or reviewed where appropriate to determine whether they remain suitable for their intended purpose.
18. Third-party and technology risk
Modern payment technology relies on a wider technology and financial ecosystem.
Wetapo may depend on external organisations for certain technology, infrastructure, communications, banking or other services.
The use of an external provider does not eliminate the need to consider the risks associated with the relevant service.
Where appropriate, Wetapo seeks to consider factors such as:
- the nature of the service;
- information processed;
- importance of the service to Wetapo operations;
- security considerations;
- operational resilience;
- dependency and concentration risk;
- contractual protections;
- data protection requirements;
- incident-management arrangements;
- and the consequences of disruption.
The level of assessment and oversight may vary according to the importance and risk associated with the relevant relationship.
Third-party ICT risk is a particularly significant component of the current EU financial-sector resilience framework: DORA requires regulated financial entities to manage such risk throughout the lifecycle of the relationship, including pre-contract assessment, ongoing monitoring and exit considerations.
This does not mean that every external provider used by Wetapo is itself a regulated financial service provider.
19. Payment ecosystem security
A Pay by Bank or Open Banking payment journey may involve multiple independent organisations.
Depending on the particular transaction, these may include:
- Wetapo;
- the Customer or merchant;
- an authorised payment service provider;
- the End User's bank;
- the beneficiary's bank;
- and other financial or technical infrastructure providers.
Each organisation is responsible for the security of the systems and activities under its control.
Wetapo seeks to design its technology so that information exchanged with other systems is limited to what is reasonably necessary for the relevant functionality.
However, Wetapo cannot control the security of independent banking environments, Customer systems or other third-party systems.
Customers should maintain appropriate security measures within their own environments and integrations.
20. Customer security responsibilities
Security is a shared responsibility.
Customers using Wetapo services should maintain appropriate controls over their own systems, employees, devices, integrations and credentials.
Customers should, where appropriate:
- restrict access to authorised personnel;
- protect credentials and authentication information;
- maintain secure devices and systems;
- apply relevant software and security updates;
- configure integrations correctly;
- monitor their own systems for suspicious activity;
- avoid exposing sensitive credentials in client-side code or public repositories;
- and inform Wetapo promptly of suspected compromise affecting their use of Wetapo.
Customers should not attempt to bypass security controls or use Wetapo services in a manner that creates unnecessary security risk.
Additional security obligations may be established in applicable contractual or technical documentation.
21. Employee and internal security
People and processes are an important part of information security.
Wetapo seeks to ensure that access to sensitive information and systems is linked to legitimate professional responsibilities.
Depending on the relevant role, internal measures may include:
- confidentiality obligations;
- access restrictions;
- appropriate onboarding and offboarding procedures;
- security awareness;
- access reviews;
- and escalation procedures for security concerns.
Access should be modified or removed when it is no longer required.
Security responsibilities may vary according to an individual's role and level of access.
22. Data minimisation
Reducing unnecessary data can reduce security and privacy risk.
Wetapo seeks to limit the collection, access and retention of information to what is reasonably necessary for the relevant purpose.
Where appropriate, we may also use measures such as:
- limiting data fields;
- restricting access;
- separating information;
- pseudonymisation;
- aggregation;
- or anonymisation.
The appropriate approach depends on the purpose and nature of the relevant processing.
Further information about personal-data retention and processing is available in our Privacy Policy.
23. Fraud prevention
Fraud prevention forms part of the wider security environment surrounding payment technology.
Wetapo may use relevant technical, transactional and operational information to identify activity that appears unusual or potentially unauthorised.
Where appropriate, suspicious activity may result in:
- additional review;
- restrictions;
- requests for additional information;
- security investigation;
- or other proportionate protective measures.
Fraud controls may evolve as threats, payment patterns and available security techniques change.
Wetapo does not publicly disclose detailed fraud-detection rules, thresholds or methodologies where doing so could reduce their effectiveness.
24. Security incidents affecting personal data
A security incident may, in some circumstances, also constitute a personal data breach.
Where Wetapo identifies an incident involving personal data, the incident will be assessed in accordance with applicable data protection requirements.
Where notification to a competent supervisory authority or affected individuals is required by applicable law, appropriate steps will be taken.
Information concerning Wetapo's broader approach to personal data is available in our Privacy Policy.
25. Continuous improvement
Information security is not static.
Technology, payment infrastructure and cyber threats continue to evolve, and security practices need to evolve with them.
Wetapo therefore seeks to review and improve its security arrangements over time based on relevant factors including:
- changes to systems;
- identified vulnerabilities;
- security events;
- testing;
- changes in threat patterns;
- operational experience;
- regulatory developments;
- and recognised security practices.
Where appropriate, lessons identified from incidents, testing or operational experience may be incorporated into future technical and organisational measures.
This general approach is also consistent with the structure of DORA, which treats ICT resilience as a continuing cycle of identification, protection and prevention, detection, response and recovery, learning and communication rather than as a one-time compliance exercise.
26. Responsible security reporting
If you believe you have identified a potential security vulnerability or security issue affecting Wetapo, we encourage you to report it responsibly.
Please provide enough information for us to understand and investigate the issue while avoiding unnecessary access to, modification of or disclosure of information belonging to other users or organisations.
When investigating or demonstrating a potential vulnerability, you should not:
- access data that does not belong to you;
- modify or delete data;
- intentionally disrupt Wetapo services;
- conduct denial-of-service activity;
- use social engineering against Wetapo personnel or Customers;
- attempt physical intrusion;
- introduce malicious software;
- publicly disclose a vulnerability before Wetapo has had a reasonable opportunity to investigate it;
- or conduct activity that violates applicable law.
A good-faith report should contain sufficient technical information to allow the issue to be understood and reproduced where reasonably possible.
Reports may be submitted to:
info@wetapo.com
Please include “Security Report” in the subject line where possible.
27. No absolute security guarantee
Wetapo takes security seriously, but no technology platform, network or information system can guarantee absolute security.
Cyber threats evolve continuously, and even well-designed security controls cannot eliminate every possible risk.
Accordingly, the information on this page should not be interpreted as a guarantee that Wetapo services will never experience a vulnerability, interruption, cyberattack or security incident.
Instead, our approach is intended to reduce security risk, improve resilience and support appropriate detection, response and recovery where an incident occurs.
Nothing in this Security Statement limits obligations that Wetapo may have under applicable law or contractual arrangements.
28. Security information and confidentiality
For security reasons, Wetapo does not publicly disclose detailed information concerning:
- infrastructure architecture;
- internal network configuration;
- security-control configuration;
- authentication architecture;
- vulnerability findings;
- penetration-testing results;
- security-monitoring rules;
- fraud-detection thresholds;
- incident-response procedures;
- cryptographic configuration;
- or other information that could reasonably increase security risk if made public.
Customers or prospective business partners with a legitimate need for additional security information may contact Wetapo.
Where appropriate, further information may be provided subject to appropriate confidentiality arrangements and the sensitivity of the information requested.
29. Changes to this Security Statement
Wetapo may update this Security Statement as our technology, services, security practices and applicable requirements evolve.
Changes may reflect:
- new products or functionality;
- changes to technology;
- developments in cybersecurity threats;
- changes to our security practices;
- regulatory developments;
- or improvements to our operational resilience framework.
The current version will be published on the Wetapo website.
The “Last updated” date at the beginning of this page indicates when it was most recently revised.
30. Contact Wetapo
For general security enquiries or to report a potential security issue, please contact:
For privacy-related enquiries, please refer to our Privacy Policy.
For complaints concerning Wetapo services, please refer to our Complaints Policy.
Effective date
This Security Statement is effective from the date stated at the beginning of this document and remains effective until amended or replaced by a later version.