Trust Center

Merchants and buyers trust us with financial and company data. This page explains how we protect it, the certifications we hold and the policies we share publicly.

Data protection

We process personal data under the GDPR and the UK GDPR. Read our Privacy Policy to see what we collect and why.

Information security

Two holds Cyber Essentials certification for the whole organisation, awarded on 3 November 2026 and due for recertification in November 2027.

Access to data is restricted by role and logged.

Our security programme is led by Douglas Lindsay, CTO and Security Lead.

Fraud prevention

Our checkout and portals use device identification to detect fraud and account takeover. Our Privacy Policy explains how this works.

Anti-money laundering and KYC

We verify the businesses we work with and their beneficial owners, and screen against sanctions lists, as anti-money-laundering rules require in each market.

For merchants

Data Processing Agreement: agreed with each merchant on request. Contact your account manager.

Sub-processors: shared under NDA, as part of a security questionnaire or a Data Processing Agreement.

Policies and certificates

Information Security Policy Overview: we will publish the current version here once our updated policies are approved.

Cyber Essentials certificate: available on request from security@two.inc.

Security questionnaires and other policies: email security@two.inc. We share internal policies under NDA.

Report a vulnerability

Email security@two.inc. Please don't access or change other users' data, and give us reasonable time to fix the issue before you disclose it.