00
Enterprise Security & Privacy
Security
Trust Starts with Evidence
Review the controls behind your Giftpack programs: GDPR certification, SOC 2 assurance, AES-256 encryption, TLS-protected connections and managed access. Built for enterprise security, privacy and procurement reviews.
Request GDPR certification details and the SOC 2 Type II report for your assessment.
Assurance You Can Assess
GDPR Certification
Certification details available for review.
SOC 2 Type II
Assurance report available by request.
AES-256
Encryption at rest.
TLS 1.2 / 1.3
Protection for data in transit.
CCPA / CPRA privacy commitments. Vanta-supported security operations.
1,400+ companies using Giftpack. Company-wide adoption, not a security certification.
GDPR Certification · CCPA / CPRA · Data Governance
Privacy Across
Every Program
Giftpack combines GDPR certification with defined data-processing responsibilities. Understand how recipient information is collected, used, shared and managed throughout your program.
GDPR Certification
Giftpack holds GDPR certification. Our privacy program brings together processing responsibilities, confidentiality and support for applicable individual-rights requests. Certification details are available through the security review process.
CCPA / CPRA
Where Giftpack processes customer personal data as a service provider or contractor, our DPA defines permitted business purposes and restrictions on selling, sharing and combining that information.
Processing Roles and Instructions
For customer-managed programs, Giftpack processes recipient and campaign data on the customer's documented instructions. Separate account administration, billing and security activities follow the roles described in our Privacy Policy.
Providers and International Transfers
Hosting, communications, fulfillment and other providers receive information relevant to their work. Subprocessor obligations and applicable transfer mechanisms, including Standard Contractual Clauses and the UK Addendum, are addressed in the DPA.
Retention, Deletion and Privacy Requests
Retention reflects the data type, purpose, customer instructions and applicable obligations. Return, deletion and individual-rights assistance follow the applicable processing terms. Contact our privacy team with questions.
AES-256 · TLS 1.2 / 1.3 · Key Management
Protect Data Across
Every Connection
AES-256 encryption protects stored data, while TLS 1.2 and TLS 1.3 secure data in transit. Key management and access controls support protection across the platform's data lifecycle.
Encryption at Rest
Giftpack uses AES-256 to protect stored data, alongside access restrictions and key management.
Encryption in Transit
TLS 1.2 and TLS 1.3 protect network communication across the relevant connections carrying customer and recipient data.
Connection Coverage
Review browser-to-platform traffic, API and integration connections, service-to-service communication and exchanges with providers. Protocol and connection details are included in the enterprise review for your deployment.
Encryption-Key Management
Keys are managed through controlled processes and authorized access. Reviews address how keys are created, stored, used, rotated and retired across relevant systems.
Access and Identity
Role-based access and least privilege limit access to authorized personnel with a business need. Internal-system MFA supports account protection; customer SSO depends on service configuration and plan.
Cloud Infrastructure
Giftpack uses Google Cloud Platform. Infrastructure protection, access controls and operational practices work together to support the service environment.
Secure Development · Monitoring · Resilience
Security Beyond
the Login
Security extends through development, daily operations and incident response. Giftpack combines controlled changes, monitoring and testing with backup and recovery practices.
Secure Development and Changes
Code and infrastructure changes follow review, testing and controlled deployment workflows to support secure software delivery.
Monitoring and Logging
Operational monitoring and logs support detection, investigation and response to security events and service anomalies. Vanta supports evidence collection and security-program operations.
Vulnerability Management
Scanning and periodic security testing, including penetration testing, identify weaknesses. Remediation is prioritized by risk, severity and operating context.
Backup and Disaster Recovery
Backup and recovery practices support continuity. Giftpack uses GCP infrastructure in Tokyo for disaster recovery. Review scope, recovery approach and applicable service commitments with our team.
Incident Response
Processes cover identification, escalation, containment, investigation, remediation and communication. Notification of confirmed incidents affecting customer personal data follows the DPA and applicable obligations.
Personnel and Provider Security
Confidentiality obligations, internal policies and security awareness support responsible data handling. Provider evaluation and contractual protections extend security and privacy considerations to third-party delivery.
SOC 2 Type II · GDPR Certification · Review Materials
The Evidence
Behind the Controls
Give security, privacy and procurement teams the materials they need to evaluate Giftpack. Review public terms and request assurance and technical information relevant to your program.
SOC 2 Type II
Giftpack maintains a report covering relevant security controls. Review the covered services and examination period.
GDPR Certification
Request certification details and the scope relevant to your assessment.
CCPA / CPRA and Vanta
The DPA addresses service-provider and contractor commitments. Vanta supports monitoring, evidence collection and operations; it is not a certification.
Public Documents
The Privacy Policy covers data use, sharing, retention and rights. The DPA covers processing responsibilities, subprocessors, security measures and international transfers.
Materials for Your Review
Request SOC 2 and GDPR details, encryption and connection information, key-management practices, subprocessor information, resilience details and questionnaire support. Restricted materials follow the appropriate review and confidentiality process.
Match the Review to Your Program
Identify services, data categories, integrations and operating locations. Our team can address relevant controls and documents, including connection paths between your systems and Giftpack.
05
Enterprise Security Review
Bring Your Requirements
Review the Details
Share your security questionnaire, procurement requirements and intended setup. Start with your organization, services, planned integrations and review timeline. We'll coordinate the technical, privacy and assurance information, with an appropriate channel for confidential documents.
Please do not include passwords, access keys or recipient records in your initial request.
Identify services, data categories, integrations and locations relevant to the review.