We use Stripe's enterprise infrastructure, SHA-256 hashed delivery evidence, and regulated financial institutions. Your money is never in our bank accounts.
Payments are processed by Stripe (PCI-DSS Level 1 certified), trusted by Amazon, Google, and Shopify. We never touch or store your card details.
Stripe Technology Europe Ltd is an Electronic Money Institution regulated by the Central Bank of Ireland. Your money is held in segregated accounts, not in Holdy's.
Every file uploaded through Holdy is SHA-256 hashed and recorded with a server-side timestamp in our append-only audit log. Verifiable evidence of what was delivered and when, included automatically when a dispute is escalated.
All data hosted on EU infrastructure. We comply with GDPR, UK GDPR, and the Dutch Uitvoeringswet AVG. Export or delete your data anytime.
All data in transit is encrypted with TLS 1.3. Data at rest is encrypted with AES-256. No unencrypted HTTP anywhere.
Database access is locked down with row-level security. You can only see your own transactions, not even our engineers can access them without proper authorization.
Primary data stored in EU data centers (Frankfurt). GDPR-compliant by default. Daily encrypted backups with 30-day retention.
Passwords hashed with bcrypt. Email verification required. Rate limiting on every endpoint. Session tokens with strict expiration.
Every transaction is screened by Stripe Radar using machine learning trained on billions of transactions across the Stripe network.
Every action is logged: deals created, payments made, disputes opened. Immutable audit trail for every transaction, queryable by you.
Full GDPR compliance including right to access, rectification, and erasure. Clear data processing agreements with all our sub-processors. See our Privacy Policy.
Sellers complete identity and, where applicable, business verification via Stripe before they can receive payouts. Stripe runs the identity, document, and sanctions checks; Holdy does not hold funds or perform KYC itself.
All payments are processed by Stripe Payments Europe Ltd, an Electronic Money Institution regulated by the Central Bank of Ireland. Strong Customer Authentication (SCA/PSD2) is enforced by Stripe on every card transaction.
Holdy is operated from the Netherlands by Basepay B.V. and is subject to Dutch consumer protection law, the EU Consumer Rights Directive, and the Digital Services Act. As a digital platform we report annually under DAC7 (Directive 2021/514).
We take security seriously. If you've found a security issue, please report it responsibly.
security@getholdy.com
Menu
For Buyers
For agencies, businesses, and freelancers' clients
For Freelancers
Get paid safely, protect your work
How it Works
The 3-step flow explained
Help Center
Guides, FAQ, support
Security
How we protect your money
Pricing
Simple fee calculator
Sign in
Create accountPowered by Stripe · EU-hosted