Within the Visa infrastructure, data is securely stored and transmitted using
standard industry practices that adhere to PCI-DSS security standards.
Specifically, Visa adheres to the following principles:

• Data in transit is encrypted.
  • For transmission of sensitive data within internal networks, the channel
    is encrypted.
  • For external transmissions, the data and channel are both encrypted.
• Sensitive data at rest is encrypted. Data at rest (stored in the database) is
  protected through the following controls:
  • Production systems are protected using a Visa zone security
    architecture that ensures bank data at rest is in restricted zones that are
    segmented from other zones, and that Visa corporate networks are
    segmented by firewalls and not accessible from the Internet.
  • Firewall restrictions include: IP, application, and data type.1/14/20
  • Procedures are in place for strict logical access to data; access to
    production data is on an individual and by-request basis, restricted to
    promote separation of duties, and inclusive of annual access
    certifications.
  • IDS/IPS are in place with the zone architecture to prevent common
    application attacks.
• PI are collected, received, used, processed, stored and/or disclosed in
  accordance with the requirements defined by the Key Controls, the
  European General Data Protection Regulation (GDPR), California Consumer
  Protection Act (CCPA), the Gramm Leach-Bliley Act (GLBA), the Payment
  Card Industry Data Security Standards (PCI-DSS), the Personal Information
  Policy and Records, and Information Management Policy.
• Visa engages a qualified security assessor (QSA) annually to validate Visa’s
  compliance with PCI-DSS.
  In order to provide services to cardholders, we collect and store the following
  information on our secure infrastructure:
• Mobile account information
  • Username
  • Password
• Device information
  • Manufacturer
  • Model
  • Operating system
  • Unique device identifiers
  • IP addresses
• Cardholder information
  • First Name
  • Last Name
  • Email Addresses
  • Phone Numbers
• Card details
  • Card number1/14/20
  • Card Expiration Date
  • Billing Address
  • Card Nickname
  • CVV2 (collected for validation purposes but not stored)

• Why do we store the above-referenced data?
  • For security purposes, we store device information and monitor
    activity.
  • For analytical and reporting purposes, we store information about
    mobile application usage and participation in card services.
  • For customer service and troubleshooting purposes, we store detailed
    information about system events.
• No sensitive information is stored on the mobile device. However, the
  following may be securely stored on the device:
  • Payment tokens may be stored in a secure cryptography protected
    white box.
  • Long-lived user tokens used for fingerprint authentication.
• In cases where data must be passed to external systems/parties to support
  a service, cardholders must opt-in to the service via the app.