Security & privacy
Vestivy is designed around data minimisation, controlled access and separation between public, customer and operational systems. Sensitive operational credentials are kept server-side and are not exposed in the browser.
TRUST & SECURITY
Trust should be
built into the product.
Vestivy is building investment gifting with clear boundaries between gifting, payments, personal data and regulated investment infrastructure.
Netherlands / EU firstLast reviewed: September 2026
OUR APPROACH
Simple for recipients.
Rigorous underneath.
Buyers should be able to understand how Vestivy approaches trust without receiving a 60-page diligence pack. This page provides high-level assurances. More detailed information can be provided during procurement or due diligence where appropriate.
GDPR
Vestivy is being built for the Netherlands and EU market with GDPR principles in mind, including purpose limitation, data minimisation and appropriate handling of personal information. Formal customer and processor documentation is made available as it becomes applicable.
Payment processing
Vestivy uses specialist payment infrastructure for payment processing. Vestivy does not need to store customers’ raw card details. Gift value and Vestivy service fees are represented separately in the platform’s transaction and reconciliation model.
Investment infrastructure
Vestivy separates the gifting experience from regulated investment infrastructure. Regulated investment activities will only be enabled through an approved investment infrastructure arrangement. Until that operating model is formally confirmed, Vestivy does not represent provider-dependent capabilities as live.
KYC / AML
Where identity verification and regulatory checks are required before investing, recipients must complete the applicable onboarding process before investment execution. Vestivy does not bypass KYC/AML requirements in order to complete a gift.
Asset protection
Vestivy’s intended model keeps the gifting layer separate from the infrastructure responsible for investment accounts, execution and custody. The final safeguarding and custody structure is provider-dependent and will be documented before real-money investment capability is launched.
Data processing
Vestivy maintains an internal due-diligence and evidence register for security, privacy, vendors and operational controls. Client-facing statements are separately reviewed and approved before they are used in sales or procurement responses.
Business continuity
Operational readiness includes provider dependencies, payment reconciliation, delivery failures, communication failures and recovery workflows. Critical issues are surfaced through Vestivy’s internal operations controls rather than treated as silent failures.
Responsible disclosure
Security concerns should be reported privately so they can be investigated responsibly. Please avoid publicly disclosing a suspected vulnerability before Vestivy has had a reasonable opportunity to review and address it.
IMPORTANT BOUNDARY
We distinguish what is live from what depends on regulated partners.
Vestivy will not describe investment infrastructure, safeguarding, custody, KYC/AML responsibilities or live investment execution as operational until the relevant provider operating model and controls have been formally agreed and implemented.
FOR PROCUREMENT & DUE DILIGENCE
Need more detail?
Business customers can request relevant information for security, privacy, legal and procurement review. We use controlled disclosure: the information shared depends on the question, stage of diligence and appropriate confidentiality level.
Request diligence information →EXPLORE VESTIVY