Skip to main content

PCI Compliance

We are committed to maintaining PCI DSS compliance. When integrating with our API, please follow these guidelines to ensure you remain compliant:

What NOT to Send​

To ensure PCI compliance and protect payment card information, do not send us:

  • ❌ Full credit/debit card numbers (PAN) in plain text
  • ❌ Card CVV/CVC codes
  • ❌ Card expiry dates in plain text
  • ❌ Card PIN numbers
  • ❌ Magnetic stripe data

Secure Payment Handling​

If your integration involves card payments:

  • ✅ Use tokenization for all card transactions
  • ✅ Implement PCI DSS requirements on your infrastructure
  • ✅ Use our secure payment endpoints (if available)
  • ✅ Store only payment tokens, never raw card data

Additional Information Field​

We offer a dynamic field (additionalInfo) for any extra data you need for reconciliation purposes. When using this field:

  • Only include non-sensitive transaction metadata
  • Use tokenized payment references where applicable
  • Never include raw card details or sensitive payment data

Best Practices​

  • Conduct regular security audits of your payment systems
  • Ensure your PCI DSS certification is up to date
  • Implement end-to-end encryption for cardholder data
  • Train your team on PCI compliance requirements
  • Monitor and log all payment-related activities

Last updated: October 2025