New: The OEM's Guide to Asset Leasing
Read now →

Latest Webinar: The Role of Digital Wallets in Consumer Lending.   Watch on demand →

Contact

|

Trust Center

Banks and lenders trust us with their customers’ data. Here you can review how we protect it: our certifications, audit reports, policies and the subprocessors we work with.

Request Access

Compliance

SOC-2 Type-2 logo

SOC 2 Type II

SOC 1 Type II

ISO 27001

PCI DSS v4.0

EU-U.S.
DPF

EU-U.S. DPF

Controls

View More

Product Security

| (6 Controls)

  • Annual external penetration test of the web application
  • Production networks scanned for vulnerabilities every quarter
  • Code changes reviewed and approved before release
  • Passing tests required before any production deployment

Access Management

| (7 Controls)

  • Least-privilege access, approved before provisioning
  • Role-based access control matrix
  • Strong password policy with two-factor authentication
  • Two-factor authentication on production, databases, source control and backups

Data Security

| (4 Controls)

  • Data encrypted in transit with TLS 1.2
  • Sensitive customer data encrypted at rest
  • Cryptographic key management process
  • Production traffic restricted by network rules and a web application firewall

Monitoring and Incident Response

| (4 Controls)

  • Security audit logs captured continuously in production
  • Threat detection monitors production for malicious activity
  • Security Incident Response Policy covering personal data breaches
  • Customers notified of service interruptions

Business Continuity

| (4 Controls)

  • Disaster recovery plan tested every year
  • Automated daily database backups
  • Backups stored across multiple availability zones
  • Backup alteration and deletion restricted to authorized users

Organization Security

| (7 Controls)

  • Security policies reviewed and approved every year
  • Annual security awareness training for all employees
  • Pre-employment screening
  • Code of conduct, acceptable use policy and NDA signed at hire

Vendor Risk Management

| (3 Controls)

  • Annual vendor and partner risk assessment
  • Risk-based security review of vendors
  • Annual review of critical vendors' SOC 2 reports

Endpoint Security

| (3 Controls)

  • Hard-disk encryption on company devices
  • Automatic patching and screen lock enforced
  • Endpoint protection on all employee devices, centrally managed

Reports and Documents

View More

SOC 2 Type II Report

July 2024 to June 2025

Request Access

SOC 1 Type II Report

July 2024 to June 2025

Request Access

ISO/IEC 27001:2022 Certificate

InterCert, IC-IS-2508174

Request Access

PCI DSS v4.0 Attestation of Compliance

SAQ D for Service Providers, August 2026

Request Access

Policies

View More

Data and Privacy Policy

v4.0

Request Access

Third-Party Risk Management (TPRM) Policy

v2.0

Request Access

Procurement Policy

v3.0

Request Access

Vendor Code of Conduct

v2.0

Request Access

FAQ

View More

How do I get Jifiti's SOC 2 report?

Select Request Access on the report. Enter your details and accept the NDA. Our compliance team reviews each request and grants access by email.

Can you complete our security questionnaire?

Yes. Most answers are covered by the documents in this Trust Center. For anything they do not cover, contact our compliance team.

Subprocessors

View More

Accurate

Employee screening

Location  USA

All Cloud

Cloud solutions partner

Location  Israel

Atlassian (Jira)

Issue tracking

Location  Australia

AWS

Servers, storage, networking, remote computing, email, mobile development and security

Location  USA | Canada | Luxembourg

Azure DevOps

Source control, build, test and release management

Location  USA

Comeet

Employee onboarding

Location  Israel

Controls

Product Security

| (6 Controls)

  • Annual external penetration test of the web application
  • Production networks scanned for vulnerabilities every quarter
  • Code changes reviewed and approved before release
  • Passing tests required before any production deployment
  • Change requests tracked from ticket to pull request
  • Development, staging and production environments segregated

Access Management

| (7 Controls)

  • Least-privilege access, approved before provisioning
  • Role-based access control matrix
  • Strong password policy with two-factor authentication
  • Two-factor authentication on production, databases, source control and backups
  • Access to restricted environments reviewed twice a year
  • Leaver access removed promptly on termination
  • New-hire access granted by role

Data Security

| (4 Controls)

  • Data encrypted in transit with TLS 1.2
  • Sensitive customer data encrypted at rest
  • Cryptographic key management process
  • Production traffic restricted by network rules and a web application firewall

Monitoring and Incident Response

| (4 Controls)

  • Security audit logs captured continuously in production
  • Threat detection monitors production for malicious activity
  • Security Incident Response Policy covering personal data breaches
  • Customers notified of service interruptions

Business Continuity

| (4 Controls)

  • Disaster recovery plan tested every year
  • Automated daily database backups
  • Backups stored across multiple availability zones
  • Backup alteration and deletion restricted to authorized users

Organization Security

| (7 Controls)

  • Security policies reviewed and approved every year
  • Annual security awareness training for all employees
  • Pre-employment screening
  • Code of conduct, acceptable use policy and NDA signed at hire
  • Formal risk management program with an annual risk assessment
  • Information asset inventory maintained
  • Office access controlled by electronic ID cards

Vendor Risk Management

| (3 Controls)

  • Annual vendor and partner risk assessment
  • Risk-based security review of vendors
  • Annual review of critical vendors' SOC 2 reports

Endpoint Security

| (3 Controls)

  • Hard-disk encryption on company devices
  • Automatic patching and screen lock enforced
  • Endpoint protection on all employee devices, centrally managed

Subprocessors

Accurate

Employee screening

Location  USA

All Cloud

Cloud solutions partner

Location  Israel

Atlassian (Jira)

Issue tracking

Location  Australia

AWS

Servers, storage, networking, remote computing, email, mobile development and security

Location  USA | Canada | Luxembourg

Azure DevOps

Source control, build, test and release management

Location  USA

Comeet

Employee onboarding

Location  Israel

Cytric

Expense declaration and travel planning

Location  Germany

Deel

Payroll services

Location  USA

Direct ID

Digital ID checks

Location  United Kingdom

Docusign

Electronic signatures

Location  USA

EiD

Electronic identification

Location  Estonia

Forter

Fraud detection

Location  Israel

Google

Accounts and hosting

Location  USA

Gstat

Risk analysis

Location  [Not verified]

Inflow

Business information

Location  [Not verified]

Jumio

KYB and KYC, AML checks, age verification, fraud detection and onboarding

Location  USA

NetSuite

Finance

Location  USA

Provenir

Credit risk decisioning

Location  USA

Salesforce Commerce Cloud

Commercial processing

Location  USA

SAT

Credit risk decisioning

Location  [Not verified]

Scytale

Certifications management

Location  USA

SEON

Fraud detection

Location  Hungary

Shapes

HR intranet hosting

Location  Israel

Zendesk

Customer support

Location  Denmark

Zignsec

KYB and KYC, AML checks, age verification, fraud detection and onboarding

Location  Sweden

Reports and Documents

SOC 2 Type II Report

July 2024 to June 2025

Request Access

SOC 1 Type II Report

July 2024 to June 2025

Request Access

ISO/IEC 27001:2022 Certificate

InterCert, IC-IS-2508174

Request Access

PCI DSS v4.0 Attestation of Compliance

SAQ D for Service Providers, August 2026

Request Access

Policies

Data & Privacy

Data and Privacy Policy

v4.0

Request Access

Third Parties

Third-Party Risk Management (TPRM) Policy

v2.0

Request Access

Procurement Policy

v3.0

Request Access

Vendor Code of Conduct

v2.0

Request Access

Business Continuity

Business Continuity Plan (external version)

v4.0

Request Access

BCP Test Report

January 2026

Request Access

DR Test Report

June 2026

Request Access

Compliance

Physical Access Policy

v5.0

Request Access

Acceptable Use Policy

v4.0

Request Access

Employee Code of Conduct

v4.0

Request Access

Anti-Bribery and Corruption Policy

v7.0

Request Access

IT Security

IT Security Policy

v4.0

Request Access

Data Loss Prevention Policy

v2.0

Request Access

Cryptography (Encryption) Policy

v3.0

Request Access

FAQ

How do I get Jifiti's SOC 2 report?

Select Request Access on the report. Enter your details and accept the NDA. Our compliance team reviews each request and grants access by email.

Can you complete our security questionnaire?

Yes. Most answers are covered by the documents in this Trust Center. For anything they do not cover, contact our compliance team.

Last updated November 2026

Public notices: Privacy Notice · Cookies Policy · Terms, Conditions and Privacy Policies

    Request access

    Tell us who you are and which documents you need. Our compliance team reviews every request. Fields marked * are required.








    Documents requested *

    Non-disclosure agreement *

    Read the full Jifiti Trust Center NDA

    By clicking "I agree", the Recipient confirms that it has read and accepts this Agreement, including the liquidated damages clause in Section 6.2 and the arbitration clause in Section 7.2.

    If approved, you will receive an email with secure access to your documents.

    Let’s talk Lending Tech

    Hi, I'm Russell.