Security overview
How Drypowder and Moov protect payment details and business data. Written for dealers and their customers, and suitable to share with your security team.
Drypowder is built so that the most sensitive part of a payment, the card or bank account number, goes straight from the payer's browser to Moov, our payment processor, which holds it in its own secured systems. This page explains how that works, what Drypowder does store, and how that information is protected. You are welcome to pass it along to your IT or security team.
Payments run through Moov
Every Drypowder payment is processed by Moov, a payments infrastructure company. As of October 23, 2026, Moov's own published materials list the following:
- PCI DSS Level 1, the highest level of the card industry's security standard
- SOC 2 Type 2 and SOC 1 Type 2 audit reports
- Nacha compliance for ACH bank payments
- Regular penetration testing by outside security researchers
- Identity verification for businesses and their owners, and recurring screening against sanctions lists
Moov's status can change after that date, so treat Moov's own pages as the current source. Its Trust Center lists its compliance reports and security controls, and security teams can request Moov's reports there. Its platform features page describes its security and verification practices.
Card and bank details go directly to Moov
When a customer pays in the Payments portal, the card or bank account number is sent from their browser straight to Moov, not through Drypowder. Drypowder's servers never receive a full card number or a card security code (CVV).
- Cards are entered into a secure form that Moov provides and hosts. The card number goes directly into Moov's card vault.
- Bank accounts are linked through Plaid, which confirms the account with the customer's bank and gives Drypowder a reference rather than the account number. Customers can also type in a routing and account number, and those are sent from the browser directly to Moov.
In place of the numbers, Drypowder keeps only what it needs to show a payment method on screen and on records: the type of card or account, the card brand or bank name, the last four digits, and Moov's reference ID for that payment method.
What Drypowder stores
Drypowder does store the business information it needs to present invoices and record payments:
| Information | Examples |
|---|---|
| Business details | Company names, addresses, and tax IDs for dealers and their customer accounts |
| People | Names, email addresses, and phone numbers of users and contacts |
| Receivables | Invoices, credits, debits, and balances received from the dealer's ERP system |
| Payment records | Amounts, dates, status, who submitted each payment, and the masked payment method described above |
How that information is protected
- Hosting. Drypowder runs on Amazon Web Services (AWS) in the United States.
- Encryption in transit. Traffic between your browser and Drypowder is encrypted with TLS 1.2 or newer. Unencrypted requests are redirected to secure ones.
- Encryption at rest. The database is encrypted with a managed encryption key that AWS rotates automatically.
- Private network. The database sits in a private network and cannot be reached directly from the internet.
- Backups. The database is backed up automatically.
- Secrets. Passwords and keys that Drypowder's own systems use are held in AWS Secrets Manager, not in application code.
- Monitoring. Every Drypowder service runs with an endpoint security agent, and network traffic is logged.
Accounts and access
- Separate data for every company. Each dealer's data is kept separate from every other dealer's. Every request is checked against the user's company and role before any data is returned.
- Roles. Users are Owners or Members of their company. Members can invite colleagues, but only Owners can change a member's role or remove them.
- Customer access starts with the dealer. A dealer approves one email address per customer account. That person then invites their own colleagues, so the customer decides who can see their financial information.
- Passwords. Passwords must be at least 12 characters and include upper and lowercase letters, a number, and a symbol. They are stored only as one-way hashes, never as readable text.
- Password reset links expire after 24 hours and work only once.
Connections to other systems
- ERP integrations. API keys that connect an ERP system to Drypowder are long random values tied to a single company. Drypowder stores only a one-way hash of each key, and keys can be rotated or revoked.
- Payment updates from Moov. Moov sends Drypowder signed notifications when a payment changes status. Drypowder checks each signature and rejects any notification that does not match.
Your part in keeping accounts secure
Dealers and their customers help keep their accounts safe by:
- Keeping logins private and never sharing passwords
- Inviting only the people who need access
- Removing users who leave the company or no longer need access
- Keeping their own bank account details current in Moov
Questions
If your security team has questions this page does not answer, contact Drypowder support or your customer success team and we will follow up directly.
Last reviewed October 23, 2026.