Trust and procurement

Last updated: November 1, 2026

For the IT, security, privacy, accessibility and purchasing offices reviewing TicketTuck for a college: how we protect your college’s data, and what we can send you.

How we protect your data

• Card numbers never reach TicketTuck. Buyers type them into secure fields hosted by your college’s payment provider, and our servers receive only a one-time token. Colleges can typically use the shortest PCI questionnaire (SAQ A), as confirmed with their card processor.
• Your money goes straight to your college. Card payments settle into your college’s own bank account. TicketTuck never holds your funds.
• Each college’s data is kept apart. Every request is checked against the college it belongs to, and automated tests check that separation before every release.
• Encryption. Everything travels over HTTPS with strict transport security. Data is encrypted at rest, and payment keys and two-step secrets are encrypted again with a key held outside the database.
• Sign-in. Two-step sign-in with an authenticator app or a passkey, which your admins can require for the whole team. Campus sign-in through your own identity provider, with SAML 2.0 or OpenID Connect.
• Roles and a record. Admin, editor and viewer roles, enforced on our servers, and viewers never see buyers’ contact details. An activity log records who did what, including when TicketTuck staff view your orders for support.
• Backups. The database can be restored to any minute in the last 30 days, and we practice the restore.
• Breach notice. If we confirm a breach affecting your data, we tell your admins without undue delay, and within 72 hours (Terms, Section 9.4).
• Your data, your call. Your admins can export everything and answer a buyer’s request to see or delete their data, and when you leave, we close the account and delete your data after your export. Personal details are removed on a published schedule (Privacy Policy).

More detail: Security, Privacy Policy, Subprocessors and Accessibility.

What we send on request

• Security overview: a short description of how TicketTuck is built and run, for IT and security reviewers.
• Your security questionnaire: we’ll complete the HECVAT, or your college’s own questionnaire, with you.
• PCI responsibility summary: which PCI DSS requirements fall to your college, to TicketTuck and to the payment providers, for your treasury or bursar’s office.
• The full subprocessor list, with each provider’s name and what it handles.
• Data processing addendum, with FERPA and GLBA terms. It’s being finalized; ask and we’ll tell you where it stands.
• Accessibility conformance report (a self-assessed VPAT, against WCAG 2.1 AA).
• Providers’ attestations: our providers’ own PCI DSS and SOC 2 reports, as each provider makes them available.

What we don’t have yet

TicketTuck doesn’t yet have its own SOC 2 report or a third-party penetration test. Both are planned, and we’re glad to tell you where they stand.

How to ask

Email security@tickettuck.com with your college’s name and what you need. For privacy questions, write to privacy@tickettuck.com. We’ll send our mailing address on request.

TicketTuck is operated by TicketTuck LLC, organized in New Jersey. About TicketTuck.