Bank details, handled properly
Most payment details still get passed around in email attachments and PDFs. Paylist exists because that's the weakest link in business payments — so security isn't a feature here, it's the whole point.
Encrypted
sort codes and account numbers are encrypted at rest and in transit
Private by default
full bank details are hidden until you choose to share them
Verified
every business is checked before it appears in the directory
How we protect you
Six things we get right, every time.
Encrypted, always
Sort codes, account numbers and IBANs are encrypted at rest using industry-standard encryption, and everything travels over TLS. Encryption keys are managed separately from the data they protect.
Private until you say otherwise
New accounts start private. Other businesses see only a masked account — enough to recognise you, never enough to pay someone else. Full details are released when you approve a request.
Least-privilege access
Access is role-based and granted on need. Our own team cannot casually browse customer bank details, and administrative access is limited to the reviews and support tasks that require it.
Verified before listed
Businesses are checked against Companies House, and bank accounts are validated — including Confirmation of Payee, where available — before anything is published. A human reviews the result.
Everything leaves a trail
Verification checks, access requests, approvals, administrative actions and detail changes are all logged. If you ever need to know who saw what and when, there's a record.
Change alerts, not change surprises
When bank details change, the businesses connected to that account are notified that something changed — never with the values themselves. Fraudulent changes get noticed fast.
Your controls
Nothing is shared without your say-so.
Security you can't operate isn't security. Every decision about who sees your payment details sits with you, in plain language, in your own settings — and every one of them is reversible.
- Keep your account private and approve each request individually, or make details available to verified Paylist users — your choice, changeable at any time.
- Withdraw access you previously granted, from your account settings, whenever you want.
- See the full history of who has requested and been granted access to your details.
- Disconnect any accounting integration at any point — its access tokens are invalidated when you do.
- Ask us for a copy of your data, or for it to be deleted, under UK data protection law.
How we build
Good habits, not good intentions.
Secure by construction
Access rules are enforced in the database itself rather than left to the interface, so a request that shouldn't return your bank details simply doesn't — regardless of where it came from.
Reviewed and tested
Changes are peer-reviewed and go through automated security and dependency checks before release. We carry out regular security reviews of the areas that handle sensitive data.
Carefully chosen providers
We work with a deliberately small number of established infrastructure and payment providers, each assessed for their security and data protection posture, and each under a written contract.
Data held in Europe
Customer data is hosted in European data centres. Where a provider processes data elsewhere, we put an approved international transfer safeguard in place first.
Just as important
What Paylist never does.
We never move your money
Paylist is a directory, not a payment provider. We hold bank details so the right ones reach the right people — we don't initiate payments, take direct debits or hold funds.
We never store card numbers
Subscription payments are handled entirely by our payment provider. Card details never touch Paylist's systems.
We never sell your data
Your information is used to run the service you're paying for. It isn't sold, rented, or handed to advertisers, and we don't use advertising or cross-site tracking.
We never publish details openly
The directory is for authenticated, verified businesses. Bank details are not indexed by search engines and are not visible to anonymous visitors.
Found something? Tell us.
If you believe you've found a security issue in Paylist, please email hello@mypaylist.com with enough detail for us to reproduce it. We'll acknowledge your report, keep you updated while we investigate, and credit you if you'd like us to.
Please test only against your own account, don't access or modify anyone else's data, and give us a reasonable opportunity to fix the issue before disclosing it publicly. We won't pursue anyone who reports in good faith along those lines.
Questions we get asked
Who can see my bank details?
Only authenticated Paylist users, and only to the extent you allow. By default they see a masked account — the account name, bank, and the last few digits — and must request the full details, which you approve or decline. You can change that setting, and withdraw access you've already granted, at any time.
Can Paylist take money from my account?
No. We store payment details so they can be shared correctly with businesses you choose. We have no ability to initiate a payment from an account listed on Paylist.
What happens if someone tries to change my bank details?
Changes are made from your own authenticated account, and the businesses connected to that account are notified that a change has occurred. Changed accounts are re-validated before they're shown as verified again.
Where is my data stored?
In European data centres. Where a provider necessarily processes data outside the UK, we rely on an appropriate transfer safeguard. Our sub-processors are listed in our privacy policy.
What happens to my data if I leave?
You can close your account and ask us to delete your data. We retain what we're legally required to keep — billing records, and evidence that verification checks were carried out — and securely dispose of the rest.
Is Paylist certified?
We're a UK company operating to the standards required by UK GDPR and the Data Protection Act 2018, with written data processing terms available to every customer. We're happy to complete security questionnaires for prospective customers — just get in touch.
For the full detail on what we collect and why, see our privacy policy and data processing agreement.
Take your bank details out of email
List once, verify once, and share a single Paylist number instead of a document anyone can alter.