How Drop protects money, identity, and privacy.

Drop Pay accounts are issued by Pathward®, N.A., Member FDIC, with verified KYC and AML checks at account opening. Payments run as tokenized EMV on the global Mastercard network. The Drop ecosystem is SOC 2, HIPAA, and PCI DSS compliant, and the band contains no GPS, microphone, Bluetooth, or battery. This page documents each standard and who stands behind it.

Member FDICSOC 2 CompliantHIPAA CompliantPCI DSS CompliantTokenized EMV

What security standards does Drop meet?

The Drop ecosystem is SOC 2 compliant, HIPAA compliant for protected health information, and handles card data exclusively in PCI DSS certified environments. Banking services are provided by Pathward®, N.A., Member FDIC, with verified KYC and AML checks at account opening.

StandardWhat it coversStatus
SOC 2 Security controls across the Drop ecosystem Compliant
HIPAA Protected health information privacy and security Compliant
PCI DSS Card data handling environments Compliant
FDIC (Member) Deposit insurance via Pathward®, N.A., pass through, to applicable limits Active
KYC / AML Know Your Customer & Anti Money Laundering. Verified identity at account opening Active

Who stands behind Drop?

Drop Industries, LLC builds and operates the Drop ecosystem, the Drop app, and the band. Pathward®, N.A., Member FDIC, issues Drop Pay accounts and provides regulated banking services. Mastercard provides the global payment network and tokenized EMV infrastructure. Each party's role is disclosed in the cardholder agreement.

The ecosystem

Drop Industries, LLC

Builds and operates the Drop ecosystem, the Drop app, and the band. Manages credentials, permissions, and the account owner experience.

The bank

Pathward®, N.A.

Member FDIC. Issues Drop Pay accounts and provides regulated banking services. Drop is the ecosystem. Pathward®, N.A. is the regulated financial institution behind it. Funds are insured to applicable limits on a pass through basis.

The network

Mastercard®

Provides the global payment network and tokenized EMV infrastructure, generating a fresh single use cryptogram at every tap.

How is money on Drop protected?

Money on Drop is held in Drop Pay accounts issued by Pathward®, N.A., Member FDIC, with funds insured to applicable limits on a pass through basis. Payments run as tokenized EMV contactless on the global Mastercard network.

Issued by a regulated bank.

Drop Pay accounts are issued by Pathward®, N.A., Member FDIC. Drop is the ecosystem. Pathward®, N.A. is the regulated financial institution behind it.

Verified account opening.

Accounts are opened with verified KYC and AML checks, and card data is handled exclusively in PCI certified environments.

Tokenized on the Mastercard network.

Every tap generates a fresh, single use cryptogram. The band never transmits a card number, because no card number exists on the band.

Can Drop Band track anyone?

No. The band contains no GPS, no microphone, no Bluetooth, and no battery. It is a passive NFC chip energized only for the instant it touches a reader. There is no signal to intercept and no location data to collect.

Nothing always on.

A passive NFC chip has no power source. It is inert until a reader energizes it at close range, and inert again the moment contact ends.

Nothing personal on the band.

No name, no login, no card number. The band carries only an encrypted payment token. A lost band exposes nothing.

Lost band protocol.

A band can be deactivated instantly from the Drop app. Order a replacement; the account, profile, and funds are untouched.

Data practices, in writing.

Our Privacy Policy documents what we collect, how it is used, and how to request deletion. It is the binding version of every statement on this page.

Security questions, answered.

Is Drop Band safe for kids? +
Yes. The band carries no personal data, only an encrypted payment token, and contains no GPS, microphone, Bluetooth, or battery, so it cannot track or transmit anything on its own. Money is protected in Drop Pay accounts issued by Pathward®, N.A., Member FDIC.
Is my money FDIC insured? +
Drop Pay accounts are issued by Pathward®, N.A., Member FDIC, and funds are insured to applicable limits on a pass through basis.
Who provides banking services for Drop? +
Banking services in North America are provided by Pathward®, N.A., Member FDIC. As Drop expands, additional regional banking partners will be listed here.
What happens to my card details when I tap? +
Nothing is exposed. Each tap generates a fresh, single use cryptogram. No card number exists on the band or passes to the merchant.
Can someone steal money by scanning the band? +
The band responds only at close range to a payment reader and transmits only a single use token. Spending is capped by the limits the account owner sets, and a found band can be deactivated instantly from the Drop app.
Who sees my family's data? +
Our Privacy Policy is the binding answer. It documents what is collected, how it is used, and how to request deletion. The band itself carries nothing personal, and the account owner controls the profile.
How do I report a security concern? +
Use the security contact on our contact page. We welcome responsible disclosure and respond promptly to verified reports.

More questions? Contact us support@drop.band