PCI compliance and security

How card data stays out of the way

The Payment Card Industry Data Security Standard (PCI DSS) applies to anyone who stores, processes or transmits card data, or who can affect its security. The less card data a system touches, the less of it falls under the standard. PayMidWare is designed around that idea.

• Hosted fields. Card and bank account details are typed into fields drawn by the payment gateway itself, not by PayMidWare or your software. The gateway swaps them for a one-time token in the customer's browser.
• Tokens, not card numbers. PayMidWare receives and stores tokens and the last four digits, brand and expiry for display. It does not receive or store full card numbers, security codes or full bank account numbers.
• No card entry form in the staff portal. To add a payment method for a customer, staff send a secure link and the customer enters the details on the gateway's own fields.
• Redacted logs. The records PayMidWare keeps of gateway calls have sensitive fields blanked out, and any long digit run that looks like a card number is masked, so card data cannot end up in a log by accident.
• Encrypted credentials. Each merchant's gateway credentials are encrypted before they are stored, write-only through the API, and never shown again.
• Sandbox and production kept apart. The two environments use separate databases and keys, and a deployment refuses to start against the other environment's data.

Where hosted fields are available

The hosted payment pages draw the gateway's own fields for: Adyen, Authorize.Net, Braintree, FluidPay, NMI, PayPal, Square, Stripe. Other gateways are supported for payments through the API, but their card entry is not provided by PayMidWare's hosted pages; ask us how a specific gateway fits your design.

Who is responsible for what

PCI DSS responsibility is shared. A short summary, not a substitute for your own advice:

• Your merchants remain responsible for their own PCI DSS compliance as merchants, under their agreements with their acquirer and gateway. Using hosted fields typically qualifies a merchant for a shorter self-assessment questionnaire, but which one applies is for the merchant, their acquirer and, where needed, a Qualified Security Assessor to decide.
• You, the software provider, are responsible for how your own application collects and passes payment details. Send tokens from the gateway's hosted fields, never raw card numbers, to keep your own scope small.
• The payment gateways are responsible for the card data they collect, store and process, and publish their own compliance documentation.
• PayMidWare is responsible for securing the systems that sit between them, as described above.