Security & Compliance Security & Compliance

Security & Compliance

Naxcol protects financial information through encryption, controlled access, defined data-use policies, and a compliance approach designed for operations in the United States and Canada. Our approach to spend management security is built to protect financial activity while keeping our data practices clear and understandable.

Why Trust Naxcol See How Naxcol Works
Protecting Financial Data at Every Stage

Protecting Financial Data at Every Stage

Financial data security starts with protecting information both when it moves between systems and when it is stored. Naxcol requires encryption across these stages so financial information used by the platform is protected throughout its lifecycle.

  • TLS 1.2+ encryption for financial data in transit
  • AES-256 encryption for financial data at rest
  • Protection for personal and business financial information

Encryption in Transit and at Rest

Naxcol uses TLS 1.2+ to protect financial data while it is transmitted and AES-256 to protect financial data while it is stored. These encryption requirements provide a technical foundation for Naxcol's fintech data security approach across the platform.

Card Security Through a Dedicated Issuing Partner
Card issuance runs through a third-party card-issuing partner rather than Naxcol issuing cards directly. PCI DSS compliance is scoped appropriately around this model, including SAQ-A or an equivalent scope where the issuing partner tokenizes Primary Account Number (PAN) data.
This structure supports Naxcol's approach to secure virtual cards while keeping card-data responsibilities appropriately aligned with the issuing partner and applicable PCI DSS requirements.
Payment Controls Built Into Virtual Cards

Payment Controls Built Into Virtual Cards

Naxcol's card functionality also provides controls over how issued cards can be used. Depending on the product and use case, virtual cards can be single-use, merchant-locked, or capped for team spending. Eligible cards can also automatically freeze when a linked subscription has a flagged price increase.

  • Single-use cards for one-time purchases or trials
  • Merchant-locked cards for recurring subscriptions
  • Capped team cards for B2B spending
  • Auto-freeze capability for flagged subscription price increases

These controls make secure virtual cards part of Naxcol's wider approach to spending control rather than simply another payment method.

Your Transaction Data Is Not for Sale

Naxcol does not sell user transaction data to third parties or share it for affiliate-driven purposes.

  • No sale of user transaction data to third parties
  • No affiliate-driven data sharing
  • No affiliate revenue influencing recommendations

This policy complements Naxcol's technical financial data security measures by establishing clear limits around how customer financial information can be used.

See Our Revenue Model

Controlled Access for Business Teams

Naxcol uses role-based access control for B2B team data so access can be assigned according to each user's responsibilities. Customer organizations are also separated within the platform's multi-tenant environment to prevent one organization's data from being accessible to another.

  • Role-based access control for B2B users
  • Admin, cardholder, and viewer roles
  • Data isolation between customer organizations
  • Controls designed for multi-tenant B2B environments

Together, access control and organization-level isolation extend spend management security to the way business information is accessed within Naxcol.

Built for Operations in the United States and Canada

Naxcol is designed for customers in both the United States and Canada. Its security and compliance requirements account for its financial-data and payment responsibilities across both markets, with specific Canadian requirements covering financial-services registration, privacy, and payment activities.

Meeting Canadian Financial and Privacy Requirements

Meeting Canadian Financial and Privacy Requirements

Naxcol's documented compliance approach addresses FINTRAC, PIPEDA, and the Retail Payment Activities Act as they apply to its Canadian operations.

FINTRAC Registration

Naxcol's requirements call for Money Services Business registration with FINTRAC, either directly or through the card-issuing partner's registration, depending on the final operating structure.

PIPEDA-Compliant Data Handling

Personal financial data for Canadian customers is to be handled in accordance with PIPEDA requirements. This forms part of Naxcol's broader fintech data security and privacy approach for the Canadian market.

Retail Payment Activities Act

Naxcol's payment functions are required to comply with applicable requirements of Canada's Retail Payment Activities Act (RPAA) where those requirements apply to the payment services being provided.

PCI DSS Requirements Are Scoped to the Card Model
Because card issuance takes place through a partner, Naxcol's PCI DSS obligations are scoped around that relationship rather than treating Naxcol as the direct card issuer. The documented approach anticipates SAQ-A or an equivalent scope where the issuing partner tokenizes PAN data.
SOC 2 Readiness Is Part of the Roadmap
Naxcol targets SOC 2 Type II readiness within 12 months of general availability. SOC 2 Type I is considered acceptable for early enterprise and B2B sales conversations. These are documented readiness targets and should not be interpreted as a claim that Naxcol currently holds SOC 2 Type II certification.

Security Also Means Being Clear About Our Incentives

Naxcol discloses interchange revenue associated with issued-card spending in plain language as part of its pricing and revenue model. Interchange revenue is not capped. Customers can clearly see that this revenue source exists and understand how Naxcol makes money.

Naxcol does not sell user transaction data to third parties or share it for affiliate-driven purposes. This gives customers a clearer understanding of how their financial information is handled and how the platform makes money.

See Why Trust Naxcol