PCI DSS Level 1
Card data never touches your servers.
Target
Security
Secure by default. Boringly reliable.
Card data never touches your servers, every action is logged, and every attestation on this page shows its real status. Security here is a setting you cannot turn off.
Built like infrastructure
3-D Secure 2
Risk-based, only when it raises approval.
TargetSOC 2 Type II
Audit under way; report on request when issued.
In progressGlobal privacy laws
GDPR, UK GDPR, LGPD, CCPA/CPRA, PIPEDA, APPI, PIPA, PIPL, DPDP, PDPL and more, with data residency by region.
Target
How to read the status chips
- Target
- A standard we are building to. Not yet assessed; no seal is shown.
- In progress
- An audit is under way. The report is shared on request when issued.
- Live
- In production today and verifiable in your dashboard.
Principles
Six principles. No exceptions.
The same controls apply to a store doing its first sale and to an enterprise account. None of them is a paid tier.
Tokenization and SparkVault
Card numbers are exchanged for tokens at the edge and stored in SparkVault, segregated from every other system. Your systems only ever see the token.
Encryption in transit and at rest
TLS 1.2 or later on every connection, AES-256 for stored data, and keys rotated on a schedule you can read in the trust report.
Access control and audit log
Role-based access, passkeys and SSO for your team, and an immutable log of every action taken on your account.
Fraud monitoring
Velocity rules, device signals and network data screen every payment; you see the reason behind every block.
Incident response
A documented process, named owners, and customer notification within the deadlines the law sets — or sooner.
Data residency EU/BR
Personal data of EU and Brazilian customers can be kept in-region, with the choice recorded per account.
Legal
The documents, in plain language.
Privacy policy
Placeholder — final legal copy pending review
This policy will describe what personal data the platform collects from merchants and from their customers, why it is collected, how long it is kept and who it is shared with. Card data is tokenized at the edge and never stored by merchants.
It will set out the rights available under the GDPR, the LGPD and comparable laws — access, correction, deletion, portability and objection — and how to exercise them through the dashboard or by email.
It will also name the data residency options for EU and Brazilian customers and the sub-processors the platform relies on, with notice before any change.
Last updated: pending
Terms of service
Placeholder — final legal copy pending review
The terms will govern the merchant account: who may open one, which businesses and goods are excluded, and the obligations around accurate information, chargebacks and refunds.
They will describe fees by reference to the pricing agreed with each merchant, the settlement schedule the merchant selects, and the circumstances in which funds may be held or a reserve applied.
They will state how either party may end the agreement, what happens to pending balances, and which law and venue apply per market.
Last updated: pending
Open-source licenses
Placeholder — final legal copy pending review
This website is built with open-source software. The projects below are used under their respective licenses; copyright remains with their authors.
Payment-method logos
The payment-method badges on this site come from Payment Icons by Shopify / Active Merchant (github.com/activemerchant/payment_icons, tag v1.7.69), used under the MIT License. Copyright 2015 Shopify Inc. The files were renamed to this site's method ids and their element ids prefixed so several icons can share a page; no artwork was changed.
The logos and word marks depicted — Visa, Mastercard, Pix, iDEAL, Bancontact, BLIK, TWINT, MB WAY, Boleto, OXXO, SPEI, UPI, Elo, Hipercard and others — remain trademarks of their respective owners and are shown only to identify the payment methods supported.
Source and licenseTypefaces
Archivo, Instrument Sans and Martian Mono are used under the SIL Open Font License 1.1.
Last updated: pending
Responsible disclosure
Report a vulnerability.
If you believe you have found a security issue in the platform, the SDKs or this site, write to us before you write about it. We read every report.
Response times are placeholders until the policy is published.
What to include
- 01The endpoint, page or SDK version affected
- 02Steps to reproduce, or a proof of concept
- 03The impact you believe it has
- 04How you would like to be credited, if at all
What you can expect
- —Acknowledgement within two business days
- —A named contact for the life of the report
- —No legal action for good-faith research
Questions about security? Talk to us.
Security questionnaires, data-processing agreements and audit reports on request.