generated: '2026-08-05'
method: searched
probe: true
url: https://trust.uphold.com/
security_page: https://uphold.com/en-us/get-started/security
certifications:
- SOC 2 Type 2
- ISO 27001
- PCI DSS
regulatory:
- FinCEN registered Money Services Business (US)
- FCA Electronic Money Issuer (UK)
- Bank Secrecy Act / AML program
- OFAC sanctions screening
privacy_regimes:
- GDPR
- CCPA
- PIPEDA
- UK Data Protection Act
transparency:
  page: https://uphold.com/transparency
  http_status: 200
  detail: >-
    Uphold publishes a public reserves transparency page built on its Reserveledger and Reservechain
    technology — an unusual, verifiable disclosure surface for a crypto platform.
bug_bounty:
  platform: Intigriti
  url: https://app.intigriti.com/programs/Uphold/upholdcom/detail
  detail: security/uphold-vulnerability-disclosure.yml
evidence:
- source: https://trust.uphold.com/
  http_status: 200
  content_type: text/html
  note: >-
    Live Trust Center (page title "Trust Center"), but a client-side-rendered Angular SPA — the served
    HTML carries no certification text, so the named certifications below were NOT read from it.
- source: https://uphold.com/en-us/get-started/security
  http_status: 200
  note: >-
    Server-readable security page. This is where "SOC 2 type 2 certification", "ISO 27001 certified" and
    "PCI/DSS" appear verbatim, alongside the FinCEN/FCA registrations and the Intigriti bug bounty.
- source: https://uphold.com/.well-known/security.txt
  http_status: 200
  note: RFC 9116 file pointing at the Intigriti program and security@uphold.com.
caveat: >-
  These are the provider's own published claims. No audit report, certificate or attestation letter was
  retrieved — the Trust Center that would normally host them does not serve its contents to a
  non-JavaScript client.