Gifting your security team can sign off

Huggg is certified to ISO/IEC 27001:2022 by NQA, certificate 193981, valid to April 2027. The scope covers all operations, including our web, API and mobile platforms.

We also hold Cyber Essentials Plus across the whole organisation, with recertification due March 2027, and we're registered with the ICO under ZA218199.

Processing happens in the UK and the EU, on AWS. There's one stated exception: an SMS sent to a phone in another country is inevitably processed in that country, so our SMS provider's processing follows the recipient's location.

Data is encrypted in transit with TLS 1.2 or above, and at rest with AES-256.

Access runs on least privilege. Role-based access controls keep customer data segregated, and only senior people who need access to a system or its data are granted it. Access is protected by MFA, logged, and monitored.

Staff cannot download customer data onto their own machines. Admin access and activity logs are retained for at least 30 days and can be shared with you on request.

Very little, and often none at all.

You can export gift links and share them however your team already communicates, in which case no recipient data reaches us. If you send through the platform, the only mandatory field is a single contact point: a work email or a mobile number.

Gift card recipients enter no personal data. For physical gifts, the recipient adds their own delivery address when they redeem, so neither you nor we need to hold it.

We run continuous automated monitoring and alerting across our infrastructure and applications. Anomalous behaviour raises automated alerts that escalate to senior engineers.

Critical security patches are applied within 14 days of us being alerted to the vulnerability. Automated vulnerability scanning runs continuously across the cloud environment and our application dependencies, risk-prioritised and tracked through our ISMS.

The platform sits behind firewalls and isolated internal networks with no public exposure, with a web application firewall, rate limiting on API endpoints, DDoS protection at the load balancer, and strict content security policies.

We have a documented incident response process. We investigate, and we notify affected clients within 48 hours of becoming aware of an incident.

Automated daily backups with versioning, and multi-zone data replication. We maintain a documented business continuity and disaster recovery plan, reviewed annually, and we test disaster recovery.

Huggg is PCI DSS compliant as a Level 4 merchant, validated by self-assessment questionnaire (SAQ A).

Card details are entered directly into hosted fields provided by Checkout.com, our PCI DSS Level 1 certified payment provider, so cardholder data is never stored or processed on Huggg systems. We hold only a token, the last four digits, the card expiry and the card scheme. Our Attestation of Compliance can be provided on request.

Yes. We share our sub-processor list and data processing agreement on request as part of your due diligence, along with our ISO 27001 and Cyber Essentials Plus certificates.

Where transfers outside the UK are unavoidable, the UK Addendum to the EU Standard Contractual Clauses applies.

Only as long as it's needed. We have a documented process for handling specific deletion requests, and we maintain a Record of Processing Activities that is reviewed quarterly.