Security and data protection: how CleverCards keeps your card and information safe – CleverCards Help Centre

Who this article is for: CleverCards Cardholders who want to understand how their card, payments, and personal information are protected.

How is access to my CleverCard Secured?

The CleverCards App uses multi-factor authentication. This means you must confirm your identity in two ways before you can view your card details, so no one can access your card with a single piece of information.

Login step	What it is	Where it comes from
Step 1: Account PIN	A 4-digit PIN that stays the same	You create it yourself when activating your first CleverCard
Step 2: Biometrics	Face ID on iPhone; face or fingerprint ID on Android	Set up on your own phone, if you choose to use it
Step 2 alternative: One-Time Passcode (OTP)	A single-use code sent to you each time you log in	Sent instantly by SMS or WhatsApp to your registered phone number

Biometrics means using a physical feature, such as your face or fingerprint, to prove it is you. If you choose not to use biometrics, the app will use a One-Time Passcode (OTP) instead: a single-use code sent to your registered phone number.

How are my payments protected?

Paying in-store

Before you can pay in a physical store, your CleverCard must be added to your phone's mobile wallet: Google Pay on Android or Apple Pay on iPhone

To make a contactless payment in a physical store, you must first unlock your phone, then tap it on the payment terminal:

On iPhone, you unlock with Face ID, Touch ID (Apple's fingerprint sensor, on iPhones with a home button), or your Apple device PIN.
On Android, you unlock with face ID, fingerprint, or your Android device PIN.

Paying online

All online card payments are secured with 3D Secure (3DS). 3D Secure is an extra identity check for payments where the card is not physically present, and it is required under European payment regulations known as Strong Customer Authentication (SCA), part of the PSD2 directive. In practice, this means you may be asked to verify an online purchase before it goes through.

Is CleverCards certified?

CleverCards adheres to best practice for data and information security:

We are PCI certified (SAQ A and SAQ EP). PCI is the Payment Card Industry security standard that governs how card data must be handled.
We are fully compliant with European Strong Customer Authentication (SCA) directives, including 3D Secure version 2 for online payments.

Do I need to verify my identity, and who can access my information?

Identity checks for CleverCards are carried out through Stripe, the regulated payments platform that issues CleverCards Visa cards. In most cases, you will not be asked to provide identity documents yourself: Stripe has already verified the business that issued your card, through a check known as Know Your Business (KYB).

Where CleverCards holds your personal information, access is restricted to dedicated members of the CleverCards Operations and Compliance team, who require it to meet CleverCards legal obligations under Anti-Money Laundering (AML) regulations, the laws that require payment companies to verify who their customers are.

How is my data stored?

CleverCards stores customer information in secure databases and data directories. As above, access is restricted to the dedicated Operations and Compliance team members who need it to meet our legal obligations.

Because your CleverCard is a Visa card issued through Stripe, Stripe also holds card and customer information securely, in line with its own regulatory obligations.

What happens if I am asked to send identity documents?

In rare cases, you may be asked to provide identity documents to complete an individual identity check, known as Know Your Customer (KYC). This does not apply to most cardholders.

If you are asked to send identity documents to CleverCards Support by email, they are handled as follows:

1. The email is routed only to the dedicated Operations and Compliance staff.

2. Your information is reviewed.

3. Your identity documents are transferred to CleverCards secure data directories.

4. The email and its attachments are then permanently deleted.

Where required, your documentation is shared securely with Stripe to complete the KYC check.