Sensitive information deserves careful handling
Onbold processes information about Sellers, Buyers, Orders, payments and the businesses behind them.
Security and data protection are therefore part of the operating model, not separate concerns added afterwards.
We collect what we need
Onbold gathers information required to understand Sellers, operate Orders, support Buyers and meet the responsibilities that come with our Merchant of Record role.
Where information can be verified directly from trusted sources, we prefer that over asking people to provide it repeatedly.
Access is controlled
Sensitive information should only be available to the people and systems that need it.
Onbold uses controlled access and clear separation of responsibilities across the platform and the providers that support it.
Payment data
Card data is received and processed only through PCI DSS Level 1 compliant payment infrastructure.
Raw card details remain within that secure payment environment. Outside it, Onbold works only with reference IDs, aliases and tokens.
Stored payment credentials are tokenised and protected within the payment infrastructure so recurring and subsequent payments can be supported without exposing raw card data to the wider Onbold platform.
Data protection
Onbold handles personal data in line with applicable data-protection requirements, including GDPR where relevant.
Access to sensitive information is limited to the people and systems that need it, and personal data is used only for legitimate operating purposes and retained in line with legal and operational requirements.
We work with specialist providers
Onbold uses established providers for areas such as payments, identity verification, company data, tax, banking, fraud and other parts of the operating model.
We select providers according to the role they perform and integrate them into a controlled environment rather than trying to recreate every specialist capability ourselves.
Data supports better decisions
Seller and Order information is used to support underwriting, monitoring, Buyer service, fraud prevention, dispute handling and other legitimate operating needs. The aim is to keep the information relevant to the relationship accurate and current without creating unnecessary duplication or manual handling.
Security continues after launch
Security is not a one-time onboarding exercise.
Access, integrations, operational controls and the information behind Seller relationships need to remain current as the platform and the businesses using it evolve.
Need the deeper detail?
This page provides a high-level overview of Onbold's approach to security and data protection.
More detailed policies, notices and technical information are available where required.