00
Enterprise Security & Privacy
Security
Trust Starts with Evidence
Review the controls behind your Giftpack programs: GDPR certification, SOC 2 assurance, AES-256 encryption, TLS-protected connections and managed access. Built for enterprise security, privacy and procurement reviews.
Request GDPR certification details and the SOC 2 Type II report for your assessment.
Assurance You Can Assess
GDPR Certification
Certification details available for review.
SOC 2 Type II
Assurance report available by request.
AES-256
Encryption at rest.
TLS 1.2 / 1.3
Protection for data in transit.
CCPA / CPRA privacy commitments. Vanta-supported security operations.
1,400+ companies using Giftpack. Company-wide adoption, not a security certification.
GDPR Certification · CCPA / CPRA · Data Governance
Privacy Across
Every Program
Giftpack combines GDPR certification with defined data-processing responsibilities. Understand how recipient information is collected, used, shared and managed throughout your program.
GDPR Certification
Giftpack holds GDPR certification. Our privacy program brings together processing responsibilities, confidentiality and support for applicable individual-rights requests. Certification details are available through the security review process.
CCPA / CPRA
Where Giftpack processes customer personal data as a service provider or contractor, our DPA defines permitted business purposes and restrictions on selling, sharing and combining that information.
Processing Roles and Instructions
For customer-managed programs, Giftpack processes recipient and campaign data on the customer's documented instructions. Separate account administration, billing and security activities follow the roles described in our Privacy Policy.
Providers and International Transfers
Hosting, communications, fulfillment and other providers receive information relevant to their work. Subprocessor obligations and applicable transfer mechanisms, including Standard Contractual Clauses and the UK Addendum, are addressed in the DPA.
Data Retention and Deletion Requests
Retention and deletion depend on the record category and applicable obligations. The Privacy Policy provides the schedule for AI connection records and explains requests to revoke access or delete data. Return, deletion and individual-rights assistance for Customer Personal Data follow the applicable processing terms. Automatically deleted after 90 consecutive days without user activity on the data. The period starts from the last user activity on that data. You may request immediate deletion by contacting privacy@giftpack.ai; you do not need to wait for the 90-day period.
Data Protection for AI Connections
Supported AI connections operate within the connected account, workspace and granted permissions. The Privacy Policy explains what information is exchanged, how it may be used, the retention of connection-related records and how to request revocation or deletion. Applicable customer processing obligations remain governed by the DPA.
AES-256 · TLS 1.2 / 1.3 · Key Management
Protect Data Across
Every Connection
AES-256 encryption protects stored data, while TLS 1.2 and TLS 1.3 secure data in transit. Key management and access controls support protection across the platform's data lifecycle.
Encryption at Rest
Giftpack uses AES-256 to protect stored data, alongside access restrictions and key management.
Encryption in Transit
TLS 1.2 and TLS 1.3 protect network communication across the relevant connections carrying customer and recipient data.
Connection Coverage
Review browser-to-platform traffic, API and integration connections, service-to-service communication and exchanges with providers. Protocol and connection details are included in the enterprise review for your deployment.
Encryption-Key Management
Keys are managed through controlled processes and authorized access. Reviews address how keys are created, stored, used, rotated and retired across relevant systems.
Access and Identity
Role-based access and least privilege limit access to authorized personnel with a business need. Internal-system MFA supports account protection; customer SSO depends on service configuration and plan.
Cloud Infrastructure
Giftpack uses Google Cloud Platform. Infrastructure protection, access controls and operational practices work together to support the service environment.
Secure Development · Monitoring · Resilience
Security Beyond
the Login
Security extends through development, daily operations and incident response. Giftpack combines controlled changes, monitoring and testing with backup and recovery practices.
Secure Development and Changes
Code and infrastructure changes follow review, testing and controlled deployment workflows to support secure software delivery.
Monitoring and Logging
Operational monitoring and logs support detection, investigation and response to security events and service anomalies. Vanta supports evidence collection and security-program operations.
Vulnerability Management
Scanning and periodic security testing, including penetration testing, identify weaknesses. Remediation is prioritized by risk, severity and operating context.
Backup and Disaster Recovery
Backup and recovery practices support continuity. Giftpack uses GCP infrastructure in Tokyo for disaster recovery. Review scope, recovery approach and applicable service commitments with our team.
Incident Response
Processes cover identification, escalation, containment, investigation, remediation and communication. Notification of confirmed incidents affecting customer personal data follows the DPA and applicable obligations.
Personnel and Provider Security
Confidentiality obligations, internal policies and security awareness support responsible data handling. Provider evaluation and contractual protections extend security and privacy considerations to third-party delivery.
SOC 2 Type II · GDPR Certification · Review Materials
The Evidence
Behind the Controls
Give security, privacy and procurement teams the materials they need to evaluate Giftpack. Review public terms and request assurance and technical information relevant to your program.
SOC 2 Type II
Giftpack maintains a report covering relevant security controls. Review the covered services and examination period.
GDPR Certification
Request certification details and the scope relevant to your assessment.
CCPA / CPRA and Vanta
The DPA addresses service-provider and contractor commitments. Vanta supports monitoring, evidence collection and operations; it is not a certification.
Public Documents
The Privacy Policy covers data use, sharing, retention and rights. The DPA covers processing responsibilities, subprocessors, security measures and international transfers.
Materials for Your Review
Request SOC 2 and GDPR details, encryption and connection information, key-management practices, subprocessor information, resilience details and questionnaire support. Restricted materials follow the appropriate review and confidentiality process.
Match the Review to Your Program
Identify services, data categories, integrations and operating locations. Our team can address relevant controls and documents, including connection paths between your systems and Giftpack.
05
Enterprise Security Review
Bring Your Requirements
Review the Details
Share your security questionnaire, procurement requirements and intended setup. Start with your organization, services, planned integrations and review timeline. We'll coordinate the technical, privacy and assurance information, with an appropriate channel for confidential documents.
Please do not include passwords, access keys or recipient records in your initial request.
Identify services, data categories, integrations and locations relevant to the review.