generated: '2026-07-18'
method: searched
source: https://www.billtrust.com/legal/data-privacy-certifications-to-security-and-compliance-certifications
summary: >-
  Billtrust publishes a security & compliance certifications page enumerating the
  audits, standards, and data-transfer frameworks it maintains as an enterprise
  accounts-receivable and B2B payments platform. Captured verbatim from the public
  legal/compliance page; no OpenAPI is published, so cross-cutting API standards
  (OAuth2/OIDC/RFC 9457) could not be derived.
compliance_program:
  published: true
  url: https://www.billtrust.com/legal/data-privacy-certifications-to-security-and-compliance-certifications
  certifications:
  - SSAE 18 SOC 1 Type 2
  - SOC 2 Type 2
  - ISO 27001:2022
  - PCI DSS v4.0.1
  - HIPAA / HITECH Act
  - NACHA
  - NFPA 1600
  - EU-U.S. Data Privacy Framework (DPF)
  - UK Extension to the EU-U.S. DPF
  - Swiss-U.S. Data Privacy Framework (DPF)
standards:
- id: soc1-type2
  conforms: true
  evidence: SSAE 18 SOC 1 Type 2 audit named on the compliance certifications page
- id: soc2-type2
  conforms: true
  evidence: SOC 2 Type 2 audit conducted annually by an independent third party
- id: iso-27001
  conforms: true
  evidence: ISO 27001:2022 certification named on the compliance certifications page
- id: pci-dss
  conforms: true
  evidence: PCI DSS v4.0.1 compliance named on the compliance certifications page
- id: hipaa
  conforms: true
  evidence: HIPAA / HITECH Act compliance named on the compliance certifications page
- id: nacha
  conforms: true
  evidence: NACHA ACH Network operating-rules adherence named on the compliance page
- id: eu-us-dpf
  conforms: true
  evidence: EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks named on the page
- id: oauth2
  conforms: false
  evidence: no public OpenAPI or developer portal available to confirm
- id: rfc9457-problem-details
  conforms: false
  evidence: no public OpenAPI or developer portal available to confirm