SumUp
Card readers, point-of-sale and online payment services for small merchants, with a UK e-money entity issuing and processing payments.
Certifications & Accreditations
| Certification | Certifying Body | Scope | Achieved | Expiry | Status |
|---|---|---|---|---|---|
| PCI DSS | No QSA named | SumUp states it is "certified as compliant under PCI-DSS", audited annually. Version, level and merchant vs service-provider status all unstated; no AoC or dates. | — | — | Current |
| PCI PTS v4.0 with SRED | Not stated by vendor | Device/terminal certification listed in the product-conformity block — not a corporate certification. | — | — | Current |
| EMV Level 1 & 2 | Not stated by vendor | Device/terminal certification. | — | — | Current |
| ISO 9001:2015 | Not stated by vendor | Listed in the product-conformity block alongside CE and UKCA declarations — scope is most likely device manufacturing/quality, not corporate operations. Certifying body not named. | — | — | Current |
Compliance Frameworks
Legal & Privacy
- Privacy Policy View ↗
Contact & Responsible Disclosure
- Security Contact [email protected]
- Responsible Disclosure View policy ↗
- Bug Bounty Platform HackerOne (private, paid)
Best security disclosure practice in this group
SumUp publishes a **valid security.txt** (expires 2035), a PGP key, a general security contact and a **paid private HackerOne bug bounty** — the strongest disclosure posture of the payments firms reviewed here.
⚠️ **Read the certification block carefully.** PCI PTS, EMV Level 1 & 2 and ISO 9001:2015 appear in a **product-conformity list** alongside CE and UKCA declarations for specific hardware (Air, 3G+, Solo, Terminal, POS Lite). These are device certifications; the ISO 9001 scope is most likely manufacturing quality rather than corporate operations.
**No ISO 27001 or SOC 2 evidence found.** UK entity SumUp Payments Limited, company 07836562, authorised under the **Electronic Money Regulations 2011, register number 900700**.
Copyright © 2026 SnapGRC