Every certification is third-party audited, not self-assessed. Compliance artefacts available to enterprise customers under NDA.
Highest tier. Annual on-site QSA audit covers all six control categories: cardholder data environment, network security, vulnerability management, access control, monitoring, and policy.
All five Trust Service Criteria tested over a continuous six-month period: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Available under NDA.
ISMS certification issued by TÜV Rheinland. Annual surveillance audits with triennial full recertification. Covers risk management, asset management, access control, and incident response.
Full EU and UK GDPR compliance. We act as data processor for merchant customer data. Signed DPA included with all plans. EU data residency ensures data never leaves the EEA.
Data is protected in transit, at rest, and in use — with no single point of key exposure anywhere in the stack.
Every transaction is scored before authorisation. Our transformer model processes 200+ signals in under 50ms — invisible to the customer.
Four independent security layers — each designed assuming all others have already been breached.
Multi-provider DDoS scrubbing at 5 Tbps capacity. WAF with OWASP Top 10 rules. TLS 1.3 only with HSTS preloading. Certificate pinning on all API endpoints.
PANs tokenised at ingestion. AES-256-GCM at rest. HSM-managed key rotation every 90 days. Least-privilege IAM with hardware MFA enforced for all production access.
ML fraud scoring before any authorisation request. Velocity checks across card, email, and IP. Device fingerprinting. 3DS 2.2 step-up challenges on high-risk transactions.
Continuous AML monitoring. KYC/KYB at onboarding and periodically thereafter. Real-time sanctions screening against OFAC, EU, UN, and HMT lists.
CREST-certified independent security firms conduct full-scope penetration tests annually. Scope covers external perimeter, API layer, internal network segmentation, cloud configuration, and social engineering simulations.
Our Security Operations Centre runs 24/7. P0 incidents receive a guaranteed human response within 15 minutes. Affected merchants are notified within one hour of a confirmed incident. Full post-mortems are published publicly within five business days.
All cardholder data, transaction records, and audit logs remain within the EEA when EU residency is enabled. Data never transits to US or APAC infrastructure.
We operate a public bug bounty programme through HackerOne. All good-faith researchers are protected by our safe harbour policy — we never pursue legal action against researchers following responsible disclosure guidelines.
Common security questions from merchants and enterprise buyers.
pg-signature header containing an HMAC-SHA256 computed over the raw request body using your webhook secret. Our SDKs provide a one-line verification method. A timestamp in the signature prevents replay attacks older than 5 minutes from being accepted.Compliance artefacts for due diligence, vendor assessments, and enterprise procurement.
Attestation of Compliance signed by our QSA. Required for formal vendor assessments and procurement in card-acceptance environments.
Current ISO/IEC 27001:2022 certificate issued by TÜV Rheinland. Covers the full scope of Paymentgate's payment processing and corporate IT systems.
Full SOC 2 Type II report covering a six-month audit period. Available under mutual NDA to enterprise customers, investors, and auditors.