Home › Payment processing › Security & compliance
Security & compliance
Security you don't have to think about
Card data never enters your software. It stays with our PCI DSS certified gateway and sponsor-bank processing partner, replaced by a token. Hosting and platform security sit with us; PCI validation stays with each merchant and the processor, and we help you complete it. Everything else is encrypted, access-controlled, backed up and yours to export.
PCI scope stays with the gatewayTokenized cardsYou own your dataNever sold
What we holdA token, the last four digits and the expiry. Enough to charge a card on file. Not enough to be worth stealing.
What we never holdFull card numbers, CVV codes or PINs. They are entered into the gateway's hosted fields and the terminal, never into our records.
Who can see itThe users you choose, with the roles you set. Our staff, only to support you, with every access logged.
Where it goes if you leaveWith you. Your merchant account is in your own name with our processing partner; your stored cards and customer records move with you as tokens and exports.
Card data
How a card number never reaches you
The safest card number is the one you never store. Our platform is built so that you cannot, even by accident.
PCI scope stays with the gateway and processorCard entry happens in the gateway's hosted fields online and in the terminal in person. Both are PCI DSS certified. Online and card-on-file payments qualify for the simplest self-assessment questionnaire; countertop terminals and kiosks use the terminal questionnaire. We charge no PCI program fee; the processor's non-compliance fee applies only if the annual questionnaire isn't completed, so we help you complete it.
TokenizationThe gateway exchanges the card for a token that only works with your merchant account. Card on file, recurring billing and retries all run on the token. A stolen token is useless anywhere else.
No card data in the records layerYour customer records, invoices, notes and exports hold a token, the last four digits and the expiry. There is no field for a full card number, so staff cannot type one in.
Encryption in transit and at restEvery connection is TLS. Terminals encrypt at the point of entry. Stored data, backups and exports are encrypted at rest.
Everything else
Access, privacy and ownership
Access controlsRoles and permissions per user, two-factor sign-in and an audit trail of who changed what. A departed employee is off in one click.
Family financial-aid data: flag onlySchool and camp editions record that aid was granted and how much. Not the application, not the income, not the documents. Those stay with the committee.
HIPAA-aware configuration for clinicsClinic editions use minimum fields, access logging, no health details in texts or subject lines, and a business associate agreement on request.
Data ownership and exportYour customers, invoices, appointments, messages and reports are yours. Export them from the dashboard at any time, in standard formats, without asking.
Uptime and backupsThe platform runs on redundant cloud infrastructure with encrypted backups and tested restores. If something affects your account, you hear it from us first.
Fraud and chargeback toolsVelocity limits, address and CVV checks, dispute alerts with the deadline and the evidence we already hold, and a team that helps you respond in time.
Plain English
What we don't do
- We don't sell your data. Not to advertisers, not to data brokers, not to the processors behind us. Your customer list is not our product.
- We don't store card numbers. Not in your records, not in ours. The gateway holds the card; we hold the token.
- We don't lock your data in. Exports are available every day, not just the day you leave. Cards migrate as tokens to another PCI-compliant provider on request.
- We don't read your messages for marketing. The AI assistant acts on your account for you; nobody mines your inbox.
- We don't hide incidents. If something affects your account, you hear it from us first, with what happened and what we did.
Report a concern. Found a vulnerability or something that looks wrong? Email hello@merchfintech.com with "Security" in the subject line. We read every report and reply to each one.
Need documentation? Boards, auditors, franchisors and school committees can request current compliance attestations from our gateway and processing partners, plus our own policies, through your account manager.
FAQ
Questions about security
Who is responsible for PCI compliance?
We keep card data out of the software; hosting and platform security sit with us; PCI validation stays with each merchant and the processor. Online and card-on-file payments qualify for the simplest self-assessment questionnaire; countertop terminals and kiosks use the terminal questionnaire. We charge no PCI program fee; the processor's non-compliance fee applies only if the annual questionnaire isn't completed, so we help you complete it.
Who can see my customer data?
You decide, with roles and permissions per user. Our support staff can access your account only to help you, every access is logged, and we never sell or share your data with advertisers. Partners who resell our platform see only the accounts they brought.
How do you handle financial-aid and medical information?
School and camp editions store financial aid as a flag and an amount, not the family's documents or income. Clinic editions are configured HIPAA-aware: minimum fields, access logging, a signed business associate agreement on request, and no health details in text messages.
What happens to my data if I leave?
It is yours. Contacts, customers, invoices, appointments and reports export from the dashboard at any time. Stored cards migrate as tokens to another PCI-compliant provider on request. We ask the same courtesy of the processors our customers leave, so we extend it ourselves. See how switching works.
How do you help with chargebacks?
Dispute alerts arrive in the dashboard with the deadline and the evidence we already hold: the signed estimate, the receipt, the delivery text, the card-on-file consent. Our team helps you respond before the deadline. Fraud rules and velocity limits stop many disputes before they start.
Any question about how your data is handled, answered.
We answer security questions in plain English, before you sign and after.
305-954-7362 · hello@merchfintech.com