Your data is protected by the same security infrastructure used by Fortune 500 companies. We take your privacy seriously.
We meet or exceed all major security and privacy standards
The highest level of payment card industry security compliance.
Independent verification of security, availability, and confidentiality controls.
Full compliance with US and EU data privacy regulations.
Your data is protected at every layer with enterprise-grade encryption
All data at rest is encrypted with AES-256, the same encryption used by the US military and banks worldwide.
All data transfers use TLS 1.2 or higher encryption, preventing interception and man-in-the-middle attacks.
Sensitive fields like SSN, bank accounts, and card data receive additional encryption layers.
We partner with industry-leading platforms to ensure your data is always secure and available
Database & Application Platform
Note: Airtable is NOT HIPAA compliant by default. HIPAA compliance requires Enterprise Grid plan with signed BAA. We do not store PHI (Protected Health Information).
Media Management & CDN
We use Cloudinary to securely store and deliver application documents:
Common questions about our security practices
All sensitive data (SSN, bank accounts, card numbers) is encrypted with 256-bit AES encryption at rest and TLS 1.2+ in transit. We use field-level encryption for the most sensitive fields, meaning they receive additional encryption layers on top of database encryption. We also implement role-based access controls (RBAC) to ensure only authorized personnel can access your data.
Your application data is stored on Airtable's infrastructure (hosted on Amazon Web Services in the United States with EU options available). Uploaded documents (licenses, statements, etc.) are stored on Cloudinary's global CDN with encryption and redundancy across multiple regions. Both platforms are SOC 2 Type II certified and GDPR compliant.
Absolutely not. We never sell your data to third parties. Your information is only shared with payment processors as necessary to provide our services. We are fully CCPA and GDPR compliant, giving you the right to access, delete, or port your data at any time.
Airtable performs automatic daily backups with point-in-time recovery capabilities. Cloudinary maintains multi-region redundancy with automatic backups. In the event of a disaster, your data can be restored with minimal to zero data loss.
Our standard platform is NOT HIPAA compliant. Airtable only offers HIPAA compliance on Enterprise Grid plans with a signed Business Associate Agreement (BAA). We do not store Protected Health Information (PHI) or medical records. If you need HIPAA-compliant payment processing, please contact us for enterprise options.
We have a comprehensive incident response plan that includes immediate detection, containment, and notification. In the unlikely event of a security breach, we will notify affected users within 72 hours per GDPR requirements. Our infrastructure partners (Airtable, Cloudinary) also have dedicated security teams monitoring 24/7.
Enterprise customers can request our SOC 2 Type II reports and third-party penetration test results. We also provide detailed security documentation and can arrange security reviews for large deployments. Contact hello@midpay.me for audit requests.
Join 1,000+ businesses trusting MidPay with their payment processing
Get Started Today →