PCI DSS Security for credit card data

Yes, certification is required You are always obliged to be able to provide proof of compliance with the current PCI DSS standard to the credit card organizations. Information on the certification process and compliance validation can be found here.

PAYONE sends a link and a password to those merchants who have to prove PCI compliance on the PCI platform. The merchant contact person for PCI can now log on to the PCI platform and is guided systematically through the next steps.

To make it as easy as possible for our merchants to select and process the right PCI questionnaire, we offer access to our PCI DSS platform. With the help of specific questions on the acceptance and processing of credit card data, the appropriate PCI questionnaire (-SAQ) type for your company is determined. It also determines whether quarterly external vulnerability scans are required to provide proof of compliance.

The self-assessment questionnaire is then provided with explanatory and help texts directly online for completion and temporary storage. You can also upload the results of external vulnerability scans to our PCI DSS platform or order them directly from our PCI cooperation partner, usd AG, at preferential conditions.

Using the Client API is a smart solution for you as a merchant that makes it extremely easy for you to prove PCI DSS compliance. The Client API enables payments to be processed without the buyer being redirected away from your online offering. Using the "Hosted Multi iFrame Solution" from PAYONE, you can integrate PCI DSS-relevant input fields for card data as individual iFrames in your individual payment form. This gives you the greatest possible flexibility while maintaining PCI DSS compliance.

To ensure reliable data security, PAYONE operates multiple server and database systems in real-time parallel operation as a maximum availability solution. Data transmission, storage and further processing of sensitive payment data is exclusively encrypted using TLS (Transport Layer Security) technology. This ensures that no third parties come into contact with the sensitive payment data at any stage of the process.

This maximum level of security at PAYONE is verified by external certification in accordance with Level 1 of the PCI DSS. In an on-site audit lasting several days, all security-relevant areas are checked in detail and compared with the strict requirements of the PCI standard. This primarily includes the up-to-dateness and permanent security of the IT infrastructure as well as the encryption and defense technologies used. All internal processes and guidelines are also carefully checked and logged against the background of the security of sensitive credit card data. The audit even goes beyond simply checking existing systems: every quarter, real attacks on the system are used to search for security vulnerabilities. In so-called penetration tests, external attacks are used to test whether it is possible to compromise the system. In this way, security vulnerabilities can be identified and rectified in good time, thus blocking the path to criminal actions in advance.