PCI DSS Security for credit card data

In principle, every merchant who accepts credit card payments is responsible for protecting the associated card data and must comply with the PCI DSS requirements. The exact requirements for compliance with the PCI DSS standards depend on your merchant level (Level 1 to 4), which in turn depends on your annual transaction volume and the type of card processing (e.g. storage, processing, transmission).

Failure to comply with PCI DSS standards can result in high penalties from the payment card organizations, increased transaction fees or even termination of your credit card acceptance agreement. Processing and storing credit card data yourself therefore not only carries a considerable financial risk for you as a merchant, but also the risk of a loss of reputation. It is therefore important to understand and implement the security requirements of PCI DSS 4.0.1 in order to protect your customers' card data and ensure the continuity of your business operations.

Yes, if you offer credit card payments, you undertake to comply with the PCI DSS security standard.

According to the regulations of the credit card organizations, the PCI DSS standard must be complied with by all companies that technically process or store credit card data. The integration of certified products from a payment service provider, such as PAYONE, means that a PCI DSS proof of compliance can be created quickly and easily. If necessary, PAYONE will ask its customers to submit proof of compliance on the PCI platform.

The question of whether a formal "certification" in the narrower sense is necessary depends on your merchant level (Level 1 to 4) and the requirements of the respective payment card organization (Visa, Mastercard, etc.). Regardless of your level, however, you are always obliged to provide proof of compliance with the PCI DSS standards (proof of compliance) to the payment card organizations. Level 1 merchants are generally obliged to have an annual audit carried out by a Qualified Security Assessor (QSA). Level 2-4 merchants can usually complete a Self-Assessment Questionnaire (SAQ) to validate compliance. PAYONE can provide you with information on the validation process and compliance validation. Here you can find detailed information on the certification process and compliance validation.

Using the Client API is a smart solution for you as a merchant that makes it extremely easy for you to prove PCI DSS compliance. The Client API enables payments to be processed without the buyer being redirected away from your online offering. Using the "Hosted Multi iFrame Solution" from PAYONE, you can integrate PCI DSS-relevant input fields for card data as individual iFrames in your individual payment form. This gives you the greatest possible flexibility while maintaining PCI DSS compliance.

PAYONE relies on comprehensive security measures to ensure the security of your data. To ensure reliable data security, PAYONE operates multiple server and database systems in real-time parallel operation as a maximum availability solution. Data transmission, storage and further processing of sensitive payment data is exclusively encrypted using TLS (Transport Layer Security) technology. This ensures that third parties do not come into contact with sensitive payment data at any stage of the process. PAYONE fulfills the requirements of PCI DSS 4.0.1.

This maximum level of security at PAYONE is verified by external certification in accordance with Level 1 of the PCI DSS. In an on-site audit lasting several days by an independent Qualified Security Assessor (QSA), all security-relevant areas are checked in detail and compared with the strict requirements of the PCI DSS standard. This primarily includes the up-to-dateness and permanent security of the IT infrastructure as well as the encryption and defense technologies used. All internal processes and guidelines are also carefully checked and logged against the background of the security of sensitive credit card data.

Every quarter, external security experts carry out penetration tests in which real attacks on the system are simulated in order to uncover potential vulnerabilities. In this way, security vulnerabilities can be identified and rectified in good time, thus blocking the path to criminal activities in advance.