--- title: Discover Dollar Security & Compliance | Trust Center description: Explore Discover Dollar’s security and compliance practices, including SOC 2, ISO 27001, GDPR, data protection, AI security, and risk controls. --- ![yourwebinar](https://5265844.fs1.hubspotusercontent-na1.net/hubfs/5265844/yourwebinar.png) - About - Solution - Case Studies - Media - Blogs - Contact - About - Solution - Case Studies - Media - Blogs - Contact Register Register for webinar [![Discover Dollar](https://www.discoverdollar.com/hs-fs/hubfs/Discover%20Dollar.png?width=266&height=46&name=Discover%20Dollar.png "Discover Dollar")](https://www.discoverdollar.com/?hsLang=en) ![63ef82b759379b22e4b1fe21\_image 129-1](https://www.discoverdollar.com/hubfs/63ef82b759379b22e4b1fe21_image%20129-1.svg) ![645368d8beeb4e7e190fb7d0\_trademark](https://www.discoverdollar.com/hs-fs/hubfs/645368d8beeb4e7e190fb7d0_trademark.png?width=485&height=485&name=645368d8beeb4e7e190fb7d0_trademark.png) ### Announcements Published on August 5, 2025 Welcome to our brand-new **Trust & Security Portal,** a single place to access all our policies, compliance documents, audit reports, and security practices. We created this space to keep our customers informed, confident, and secure.   ### Compliance Documentation of our compliance against global standards including certifications, attestations, and audit reports. ![general-active-logo.fc2e36cff8509b820b4f](https://www.discoverdollar.com/hs-fs/hubfs/general-active-logo.fc2e36cff8509b820b4f.png?width=212&height=212&name=general-active-logo.fc2e36cff8509b820b4f.png) Business Continuity Plan ![general-active-logo.fc2e36cff8509b820b4f](https://www.discoverdollar.com/hs-fs/hubfs/general-active-logo.fc2e36cff8509b820b4f.png?width=212&height=212&name=general-active-logo.fc2e36cff8509b820b4f.png) Risk Assessment Download Doucments ### Security: SOC 2 Type 2 Report GDPR Report ISO 27001: 2022 Certificate ISO 42001:2023 Certificate VAPT Report (Redacted) ### Policies: Incident Response Policy Infrastructure and data security Policy Data Retention Policy Breach Notification Procedure Responsible AI Use Policy Whistleblower Protection Policy Download Doucments ### Continuous monitoring ##### App Security Penetration Test Code ReviewProcess Vulnerability Assessment Secure SDLC Vulnerability Management Web Application Firewalls. ##### Data Security Data Backups Data Encryption Data Governance SSL/TLS Enforcement Strict Access Control Policy ##### Infrastructure Security Baseline Security Setup on our Cloud. Encryption at rest Password Policy 24/7 SOC Monitoring Malware detection & EDR Automated Patching ##### Network Security Firewall Logging and Monitoring 24/7 SOC Monitoring ##### Organization Security Acceptable Usage Policy Code of Conduct Disaster Recovery Plan Incident Response Plan Dedicated Security Team Security Awareness and Training ### Subprocessors ![aws.amazon-\_1\_](https://www.discoverdollar.com/hs-fs/hubfs/aws.amazon-_1_.png?width=128&height=128&name=aws.amazon-_1_.png) #### Amazon Web Services Cloud computing services including Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) offering. Location: US ![gemini.google](https://www.discoverdollar.com/hs-fs/hubfs/gemini.google.png?width=512&height=512&name=gemini.google.png) #### Google Artificial intelligence research and deployment, including AI models like Gemini Location: US ![azure.microsoft](https://www.discoverdollar.com/hs-fs/hubfs/azure.microsoft.png?width=128&height=128&name=azure.microsoft.png) #### Azure OpenAI Artificial intelligence research and deployment, including AI models like GPT (Generative Pre-trained Transformer), Location: US ![stripe](https://www.discoverdollar.com/hs-fs/hubfs/stripe.png?width=128&height=128&name=stripe.png) #### Stripe Stripe provides billing, subscription, and invoicing services. Location: US ![www.anthropic](https://www.discoverdollar.com/hs-fs/hubfs/www.anthropic.png?width=512&height=512&name=www.anthropic.png) #### Anthropic Artificial intelligence research and deployment, including AI models like Claude Location: US ### Frequently Asked Questions Detailed, plain-language answers to the questions security, procurement, and privacy teams ask us most before signing off on Discover Dollar. What is the Discover Dollar Trust & Security Portal, and why does it exist? This portal is Discover Dollar's single source of truth for how we protect the accounts payable and financial data our customers upload to Shield — the certifications we hold, the policies we operate under, and the controls we run day to day, all in one place instead of scattered across emails and one-off security questionnaires. We publish it because our platform ingests sensitive AP data (invoices, purchase orders, contracts, emails, payment records) to detect overpayments, so procurement, security, IT, and legal teams evaluating us as a vendor need fast, verifiable answers before they trust us with that data. Every certificate, audit report, and policy linked above is the primary source of record; this FAQ section explains what they mean and how they fit together, it doesn't replace them. What certifications does Discover Dollar hold, and what does each one actually certify? We hold three independent certifications or attestations, each covering a different layer of assurance: - **SOC 2 Type II** — an AICPA attestation confirming our controls were designed *and* operated effectively over an observation period, not just documented on paper. - **ISO/IEC 27001:2022** — certifies we run a documented Information Security Management System (risk assessments, control ownership, continuous improvement), audited by an accredited certification body. - **ISO/IEC 42001:2023** — a newer standard specific to AI management systems, covering how we govern, test, and monitor the AI models built into our product. We also publish a GDPR assessment report and a redacted VAPT (penetration test) report. Downloadable copies of all of these are in the Security section above. I need a document that isn't listed here — a security questionnaire, an unredacted VAPT report, or something under NDA. How do I get it? Everything we can share publicly is already linked in the Security and Policies sections above. For anything more sensitive — a full-detail penetration test report, responses to a custom vendor security questionnaire, or a document that requires a mutual NDA before we can share it — email [privacy@discoverdollar.com](mailto:privacy@discoverdollar.com) with your company name and what you need. Our security team reviews these requests individually rather than through a self-serve form, since some documents can only go out once an NDA is on file. How does Discover Dollar actually protect the data I upload, beyond a general promise to "take security seriously"? Protection happens at four layers, all listed under Continuous Monitoring above: - **Application:** a Secure SDLC, code review, regular penetration testing and vulnerability assessments, and web application firewalls. - **Data:** encryption at rest, SSL/TLS enforced in transit, defined data governance rules, and regular backups. - **Infrastructure:** a hardened cloud baseline, 24/7 SOC monitoring, malware detection and EDR, and automated patching. - **Organization:** least-privilege and Zero Trust access under a Strict Access Control Policy, enforced with a password policy, a dedicated security team, and mandatory security-awareness training. No single control is the whole story — it's the combination, reviewed continuously, that we publish above. Discover Dollar's product uses AI — what does that mean for the safety of my company's financial data? Our AI-driven overpayment detection draws on models from more than one provider — Anthropic's Claude, Google's Gemini, and GPT via Azure OpenAI — selected by task rather than depending on a single vendor. Each is contractually bound as a subprocessor (see below) and processes only the data needed for the specific analysis requested; none is authorized to use customer data to train its own foundation models under our agreements. How we build, test, and monitor these AI features — including human review points and model risk management — is governed by our Responsible AI Use Policy. Our ISO/IEC 42001:2023 certification specifically audits this AI governance process, not just our general infrastructure. Who are Discover Dollar's subprocessors, and why does each one have access to data? We use five subprocessors today, each doing one specific job, all located in the US: Amazon Web Services hosts our infrastructure (IaaS/PaaS); Google's Gemini and Azure OpenAI's GPT models power parts of our AI analysis; Anthropic's Claude powers another part of it; and Stripe handles billing, subscriptions, and invoicing only — it never touches your AP data. We keep this list current on this page rather than only inside a contract exhibit, and we update it whenever a subprocessor is added, removed, or changed. Check the Announcements section at the top of this page for the latest change log. How long does Discover Dollar keep my company's data, and what happens after I stop being a customer? Retention timelines and secure-deletion procedures for each category of data we hold are defined in our Data Retention Policy, downloadable in the Policies section above — we don't keep data longer than necessary to deliver the service, meet contractual commitments, or satisfy a legal or regulatory retention requirement. If you have a specific question about your account — for example, exactly what happens to your data after contract termination — that's best answered against your specific agreement, so reach out to [privacy@discoverdollar.com](mailto:privacy@discoverdollar.com) and we'll walk through it with you directly. What happens if Discover Dollar has a security incident or data breach? We run a two-part process. Our **Incident Response Policy** defines how our security team detects, triages, contains, and remediates an incident internally, including escalation paths and a post-incident review. Our **Breach Notification Procedure** defines who we tell, how fast, and through what channel if an incident is confirmed to involve customer data, aligned to the notification obligations in the regulations that apply to that data. Both documents are downloadable above. In short: we don't wait for a scheduled audit to find out something went wrong, and we don't stay quiet if it affects you. Is Discover Dollar GDPR compliant, and what rights do I have over my data? Yes. Our GDPR assessment report, available in the Security section above, documents our compliance posture against the regulation. Our [Privacy Policy](https://www.discoverdollar.com/privacy-policy?hsLang=en) explains, in plain language, what personal data we collect, why, the legal bases we rely on, and the rights available to data subjects — including access, correction, deletion, portability, and objection, depending on your jurisdiction. To exercise any of those rights or ask a GDPR-specific question, email [privacy@discoverdollar.com](mailto:privacy@discoverdollar.com); we handle these directly rather than through a generic support queue. How often does Discover Dollar test its own security, and can I see the results? Security testing is continuous, not annual box-checking: we run regular vulnerability assessments and penetration tests, supported by ongoing vulnerability management and a Secure SDLC that catches issues before code ships, plus web application firewalls that catch what testing might miss once code is live. Our most recent VAPT report is published in redacted form in the Security section above — redacted so it documents our findings and remediation without publishing an exploit roadmap to anyone browsing this page. A fuller version can be discussed under NDA (see the question above on requesting additional documents). Who inside Discover Dollar can actually see or touch customer data? Access is restricted by our Strict Access Control Policy, built on least-privilege (you get access to exactly what your role requires, nothing more) and Zero Trust (access is verified continuously, not assumed because a device or user is "inside the network"). That's reinforced structurally: a dedicated security team owns access governance, a company-wide Password Policy sets authentication standards, and every employee — not just engineers — goes through security awareness and compliance training as a condition of employment, backed by our Code of Conduct and Acceptable Usage Policy. What's Discover Dollar's plan if there's an outage, natural disaster, or other major disruption? We maintain two related but distinct plans: a **Business Continuity Plan**, covering how the organization keeps operating — people, processes, communication — through a disruption, and a **Disaster Recovery Plan**, covering how our technical systems and data specifically get restored. Both sit alongside a formal risk assessment framework that identifies what could go wrong before it does, so continuity planning isn't theoretical. The Business Continuity Plan is downloadable in the Compliance section above; ask your account contact if you need specifics for a vendor risk review. How often is this Trust & Security Portal updated, and how do I know if something changed? We update this page whenever something material changes — a certification is renewed or added, a policy is revised, or our subprocessor list changes — rather than on a fixed schedule, so what you're reading reflects our current posture, not a snapshot from whenever we last remembered to check. The Announcements section at the top of this page is where we log those updates. If you're relying on this page for an ongoing vendor review, it's worth bookmarking the live page rather than saving a static copy. I have a security or privacy question that isn't answered here — who do I actually talk to? For anything privacy-related — data subject requests, GDPR questions, or clarifications on our Privacy Policy — email [privacy@discoverdollar.com](mailto:privacy@discoverdollar.com) directly. For security questionnaires, deeper technical due diligence, or documents that require an NDA, route through your Discover Dollar account contact, who will loop in our security team — that way requests tied to an active commercial relationship get the context (timeline, contract) they need to be answered properly, rather than sitting in a generic inbox. ### Additional Details: **Trust Through Transparency. Security by Design.** At Discover Dollar, security and privacy aren’t features - they’re foundations. We build with **Security by Design** and **Privacy by Default**, ensuring every product decision prioritizes risk mitigation, transparency, and global compliance from day one. Our commitment includes: - Regular security reviews and third-party audits - Transparent policies for customers and regulators - Modern principles like Zero Trust and least privilege - Company-wide security awareness and compliance training In today’s digital world, **trust is currency** and we earn it every day. ### Privacy Details Privacy Details: For Privacy related information please follow the link: [Discover Dollar Privacy Policy](https://www.discoverdollar.com/privacy-policy?hsLang=en)Or Contact: privacy@discoverdollar.com   All rights reserved © Grow Poland 2024 Privacy Policy Meet us in socials: ```json { "@context" : "https://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "US" }, "description" : "Discover Dollar is a US-based audit recovery and profit optimization company helping enterprises prevent profit leakage.", "logo" : "https://www.discoverdollar.com/hubfs/image%203.svg", "name" : "Discover Dollar", "sameAs" : [ "https://www.linkedin.com/company/discover-dollar" ], "url" : "https://www.discoverdollar.com/" } ``` ```json { "@context" : "https://schema.org/", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/solutions", "name" : "By Solutions", "position" : 2 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/shield", "name" : "Shield", "position" : 3 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/solutions-by-function", "name" : "By Functions", "position" : 4 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/industry", "name" : "By Industry", "position" : 5 }, { "@type" : "ListItem", "item" : "https://blog.discoverdollar.com/", "name" : "Blogs", "position" : 6 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/case-study", "name" : "Case Study", "position" : 7 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/white-paper-report", "name" : "White Paper", "position" : 8 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/events-0", "name" : "Events", "position" : 9 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/solutions#solutionsfaq", "name" : "FAQ's", "position" : 10 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/about", "name" : "About Us", "position" : 11 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/security-discover-dollar", "name" : "Trust & security", "position" : 12 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/career", "name" : "Career", "position" : 13 }, { "@type" : "ListItem", "item" : "https://www.discoverdollar.com/news", "name" : "News", "position" : 14 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "It is Discover Dollar's single source of truth for the certifications, policies, and controls that protect the accounts payable and financial data customers upload to Shield, published so procurement, security, IT, and legal teams can evaluate us as a vendor without one-off questionnaires." }, "name" : "What is the Discover Dollar Trust & Security Portal, and why does it exist?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Discover Dollar holds SOC 2 Type II, ISO/IEC 27001:2022 for information security management, and ISO/IEC 42001:2023 for AI management systems, plus a GDPR assessment report and a redacted VAPT penetration test report, all downloadable from the Security section." }, "name" : "What certifications does Discover Dollar hold, and what does each one actually certify?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Email privacy@discoverdollar.com with your company name and what you need; sensitive documents such as a full VAPT report or NDA-gated materials are reviewed and shared individually by the security team." }, "name" : "How do I get a security document that isn't listed on this page?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Through layered controls: application security (Secure SDLC, penetration testing, web application firewalls), data protection (encryption at rest, SSL/TLS in transit, backups), infrastructure security (24/7 SOC monitoring, EDR, automated patching, firewalls), and organizational security (least-privilege and Zero Trust access, security awareness training)." }, "name" : "How does Discover Dollar protect uploaded data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Discover Dollar uses AI models from Anthropic, Google, and Azure OpenAI as contractually bound subprocessors under a Responsible AI Use Policy; none of these providers is authorized to use customer data to train their own models, and AI governance is independently certified under ISO/IEC 42001:2023." }, "name" : "Does Discover Dollar's AI use put my financial data at risk?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Amazon Web Services (infrastructure hosting), Google (Gemini AI), Azure OpenAI (GPT models), Anthropic (Claude AI), and Stripe (billing and invoicing only), all located in the US and kept current on this page." }, "name" : "Who are Discover Dollar's subprocessors?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Retention periods and secure-deletion procedures are defined in Discover Dollar's Data Retention Policy, available for download on this page; data is not kept longer than necessary for the service, contract, or applicable legal requirements." }, "name" : "How long does Discover Dollar retain customer data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Discover Dollar follows a documented Incident Response Policy to detect, contain, and remediate incidents, and a Breach Notification Procedure to notify affected customers and regulators in line with applicable legal timeframes." }, "name" : "What happens if Discover Dollar has a data breach?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Discover Dollar publishes a GDPR assessment report and a Privacy Policy describing data collected, legal bases, and data subject rights; privacy questions can be sent to privacy@discoverdollar.com." }, "name" : "Is Discover Dollar GDPR compliant?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, Discover Dollar runs regular penetration tests and vulnerability assessments alongside a Secure SDLC and web application firewalls, and publishes a redacted VAPT report on this portal." }, "name" : "Does Discover Dollar perform regular penetration testing?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Access follows a Strict Access Control Policy based on least-privilege and Zero Trust principles, enforced by a dedicated security team, a company password policy, and mandatory security awareness training for all employees." }, "name" : "How does Discover Dollar control employee access to customer data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, Discover Dollar maintains a Business Continuity Plan and a Disaster Recovery Plan alongside a formal risk assessment framework, downloadable from the Compliance section of this portal." }, "name" : "Does Discover Dollar have a business continuity and disaster recovery plan?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The portal is updated whenever certifications, policies, or the subprocessor list change, with updates logged in the Announcements section at the top of the page." }, "name" : "How often is the Discover Dollar Trust and Security Portal updated?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Privacy questions go to privacy@discoverdollar.com; security questionnaires and NDA-gated technical due diligence should be routed through a Discover Dollar account contact." }, "name" : "Who do I contact with a security or privacy question about Discover Dollar?" } ] } ```