Security & Compliance
Your data is encrypted, access-controlled and tested by outsiders. Affiliates are verified and screened before they’re paid.
- SOC 2
SOC 2 · In progress
We’re working toward SOC 2. The report is yours once it’s issued.
- GDPR
GDPR · DPA ready
Personal data handled under the GDPR, with a DPA to sign.
- CCPA
CCPA · Rights honored
California privacy rights honored, and referral data never sold.
- KYC
KYC and AML · On payouts
Partners verified and screened against sanctions lists.
Affiliate programs running on Tolt
High Performer on G2, Fall 2026Security practices
01Encryption
- Encrypted in transit
- Encrypted at rest
02Your team’s access
- Two-factor sign-in
- Single sign-on
- Team roles
- Audit log
03Our team’s access
- Need-to-know access
- Security monitoring
- Regular security audits
04Testing
- Third-party penetration tests
- Vulnerability disclosure
05Resilience
- Backups
- Public status page
06Webhooks
- Signed messages
- Retries and replay
- Optional IP allowlist
Data handling
What we track
1 ID
One random ID in a first-party cookie on your own domain. tlt.js reads no other cookies and follows no one across the web.
Webhook data
7 days
What Stripe, Paddle or Chargebee send about a referred customer is kept for debugging, then deleted on its own.
After you leave
30 days
Cancel, and the personal data in your account is deleted within 30 days.
Sold to anyone
Never
Referral data is shared only with you. Partners see a redacted email, what was paid and their commission.
Rather not send emails at all? Send your own anonymous IDs through the API, and Tolt never learns who your customers are.
Read the privacy policyPayout compliance
With auto payouts, Tolt pays your affiliates for you, as their agent, from one invoice you approve. Nobody is paid until they pass.
01 · KYC
Identity checks
Partners confirm who they are before their first auto payout.
Pay a fake account: the money is gone.
02 · AML
Sanctions screening
Partners are screened against sanctions lists before they’re paid.
Pay someone on a sanctions list by mistake: up to $377,700.
03 · W-9 and W-8
Tax forms
Partners sign a W-9 in the US or a W-8 abroad. No form, no payout.
Pay a US partner with no W-9: the IRS wants 24% of it.
04 · Each January
1099 filing
After the year’s payouts, Tolt files a 1099 for every eligible US partner, ready for your accountant.
Miss a 1099: up to $340, and again for their copy.
Status
Checking our status page
Documents
Start with these, or send us your questionnaire and we’ll fill it in.
- Data processing agreementOn requestThe DPA for GDPR and CCPA, ready to sign.Request
- Subprocessor listOn requestEvery service that touches your program’s data.Request
- Penetration test summaryOn requestWhat our latest outside test looked at, and what it found.Request
- SOC 2 reportIn progressWe’re working toward SOC 2. We’ll send the report the day it’s issued.Get notified
- Privacy policyPublicWhat we collect, why we keep it, and your rights.Read
- Terms of servicePublicHow Tolt works with you, and with your partners.Read
- Privacy requestsContactAccess, correct or delete personal data.Email us
- Report a vulnerabilityContactFound a security issue? Tell us first, privately.Email us
Security FAQ
Data and privacy
Do you sell or share my data?
No. Referral data is shared only with you, the admin, and is never sold to third parties. Partners see only a redacted email, what was paid and their commission.
What does Tolt’s tracking cookie store?
One random ID, in a first-party cookie on your own domain, set when a visitor arrives through a partner’s link. tlt.js doesn’t read other cookies or follow anyone across sites.
How long do you keep data?
What your billing tool sends about a referred customer is kept for 7 days for debugging, then deleted on its own. If you cancel, the personal data in your account is deleted within 30 days.
- Webhook data on referred customers
- 7 days
- Your account’s personal data, after you cancel
- 30 days
What can affiliates see about my customers?
Only what they need to trust their earnings: each customer’s email, redacted, the amount paid and the commission it earned them.
Security
Do you support SSO and two-factor sign-in?
Yes. Your team can sign in with two-factor authentication or single sign-on, roles limit what each person can do, and an audit log records every change.
Is Tolt SOC 2 compliant?
We’re working toward SOC 2 now. Ask to be notified and we’ll send the report as soon as it’s issued. In the meantime, our DPA and subprocessor list are available on request.
Get notifiedDo you run penetration tests?
Yes. Independent testers try to break into Tolt regularly. Your data is encrypted in transit and at rest, backed up, and reachable only by the people whose job needs it.
How are Tolt’s webhooks secured?
Every webhook is sent through Svix and signed. Verify the signature before you trust a payload and, if you like, accept requests only from Svix’s IP ranges.
Webhooks in the help centerCompliance
Is Tolt GDPR and CCPA compliant?
We follow the GDPR and the CCPA: you can access, correct, delete or export personal data, and we sign a DPA with customers who need one. Write to compliance@tolt.com.
How do I get your DPA and subprocessor list?
Email compliance@tolt.com and we’ll send both. The DPA is ready to sign.
Request the DPAHow do you handle tax forms and sanctions for payouts?
With auto payouts, partners confirm their identity, are screened against sanctions lists and sign a W-9 or W-8 before they’re paid. Each January, Tolt files 1099s for eligible US partners.
How auto payouts workHow do I report a vulnerability?
Email compliance@tolt.com with the details. Please give us the chance to fix it before you share it publicly.
- DPA ready to sign
- Third-party penetration tests
- Questions to compliance@tolt.com