'%20/%3e%3c/svg%3e){kind=small}
Independently audited security & compliance
Payouts.com maintains its own SOC 2 Type II and SOC 1 Type II audits — both with clean opinions — and tokenizes sensitive card data with Very Good Security (VGS), a PCI DSS Level 1 provider. Every report below is the work of an independent auditor.
- SOC 2 Type II — clean opinion
- SOC 1 Type II — clean opinion
- PCI DSS Level 1 card-data vault
Audited end to end, independently verified
Our SOC 2 & SOC 1 audits
These are Payouts.com’s own independent audits — reporting entity Payouts Technologies Ltd. (formerly Mrkter Technologies L.B.O. Ltd.). Both received clean opinions from an independent service auditor.
Trust Services Criteria covered:
Controls in scope:
Includes complementary user-entity controls (CUECs) and complementary subservice-organization controls.
Opens in a new browser tab. If your browser blocks the in-tab preview, use Download to save the file locally.
Control objectives tested — no exceptions material to the opinion:
Reporting entity since renamed to Payouts Technologies Ltd. (Oct 16, 2025). Designed for user-entity auditors evaluating ICFR for transactions processed by Payouts.com.
Opens in a new browser tab. If your browser blocks the in-tab preview, use Download to save the file locally.
Attestation of Compliance — PCI DSS v4.0.1
Separately from Payouts.com’s own SOC audits above, sensitive card data is vaulted and tokenized by Very Good Security, Inc. (VGS). The VGS platform is assessed annually against the Payment Card Industry Data Security Standard by an independent Qualified Security Assessor.
Assessment details
Scope of assessment
Services included in the assessed VGS Platform:
Assessed service categories:
Independent penetration tests
NetWorks Group (NWG) ran full-scope and web-application penetration tests against the VGS card-data platform, simulating real-world attackers from both unauthenticated and assumed-compromise positions.
- External systems are minimal and well-secured.
- Internal segmentation is effective — no vault hosts reachable from the general network.
- Internal detections and monitoring are timely and accurate.
Only finding: outdated JavaScript dependencies (low severity) — testers were unable to exploit it. All injection, traversal, auth-bypass and open-redirect attempts were unsuccessful; TLS 1.2+ and a Content Security Policy are enforced.
How this protects your business
Independently validated
SOC 2 and SOC 1 audits, a PCI DSS Qualified Security Assessor, and external penetration testers verify these controls — results are not self-reported.
Reduced PCI scope
Raw card numbers are tokenized inside the VGS vault, so sensitive cardholder data never touches Payouts.com systems — shrinking the compliance burden on your side too.
Defense in depth
TLS 1.2+ in transit, AES-256 at rest, network segmentation, and monitored detections that respond to threats in real time.
Download the assessment reports
Payouts.com’s own SOC reports plus the independent reports for our VGS card-data infrastructure. For full customer due-diligence packages, contact our team.
Payouts.com · SOC reports
Card-data infrastructure · VGS
The SOC 2 Type II and SOC 1 Type II reports are Payouts.com’s own independent audits, issued to Payouts Technologies Ltd. (formerly Mrkter Technologies L.B.O. Ltd.). The PCI DSS Attestation of Compliance and penetration-test reports cover Very Good Security, Inc. (VGS) — the PCI DSS Level 1 tokenization and vault provider Payouts.com relies on for cardholder-data security. SOC reports are confidential; some uses may require an NDA — see the Security overview or contact our team.
Questions about our security posture?
Talk to our team about data isolation, controls, and the due-diligence package for your compliance review.