Search Help Center

Toku's security practices for employees and vendors, including background checks, device security requirements, least-privilege access controls, and third-party vendor assessments to protect customer data.

Toku uses TLS 1.3 encryption for data in transit and AES-256 for data at rest, with keys managed through automated rotation.

Toku integrates with HRIS, payroll, and custody platforms using OAuth 2.0 authentication with minimal permissions and IP whitelisting.

Toku's incident response framework covers detection, triage, response, and resolution of security and operational incidents with severity levels (SEV-1 to SEV-4) and defined roles.

Toku's business continuity and disaster recovery plans ensure payroll and payment processing remain operational during disruptions.

Learn how Toku secures access through SAML 2.0 SSO, enforced MFA, automated user provisioning via SCIM, and role-based access control. Includes details on session management, access reviews, and comprehensive authentication logging.

Toku's compliance certifications and security practices, including SOC 2 Type II, GDPR, CCPA/CPRA, and SOX compliance. Details on security controls, penetration testing, and available documentation for clients.

Toku's endpoint security framework uses CrowdStrike Falcon for threat detection, Jamf for device management, and Tailscale for zero-trust network access.

Toku operates a strict non-custody model where clients retain full control of funds and private keys.

Toku's 2026 security hardening program strengthened infrastructure, endpoints, networks, and applications through endpoint protection deployment, zero-trust VPN access, credential rotation, enhanced monitoring, and third-party security assessments by Sygnia and Quantstamp.

Toku's secure development practices include mandatory peer reviews, continuous vulnerability scanning, quarterly security audits, and encrypted secret management.

Toku's infrastructure uses DigitalOcean hosting with SOC 2 certification, Cloudflare WAF/DDoS protection, and Tailscale zero-trust VPN.