Foundation · 2 min
What you need to know
How should ecommerce stores protect payment information?
Use a supported payment integration that limits the card data handled by the store, restrict staff access and keep the checkout and accounts secure. Keep sensitive payment details out of logs, chat and email. Verify responsibilities with the provider and acquirer.
What is PCI DSS?
PCI DSS means Payment Card Industry Data Security Standard. It sets security requirements for protecting payment account data. The applicable validation and scope depend on how the business accepts payments and on its environment.
Does every ecommerce merchant need to understand PCI responsibilities?
Yes. Outsourcing payment processing can reduce the data the store handles but does not remove all merchant responsibilities. Confirm your integration type and required validation with the relevant acquirer or compliance professional rather than assuming a provider logo makes the whole store compliant.
Should ecommerce stores save card numbers?
A small store should normally use its provider’s supported saved-payment service instead of keeping full card numbers itself. Never retain card verification codes after authorisation, even encrypted. Card data storage adds obligations that an ordinary order database is not designed to meet.
What is payment tokenisation?
Tokenisation replaces a sensitive payment value with a substitute reference usable within a defined payment system. A merchant can offer a supported saved-card checkout without staff being able to read the original card number. The exact token type and permitted uses matter.
Tokenisation vs encryption: what’s the difference?
Encryption transforms data so it can be recovered with the appropriate key; tokenisation substitutes a reference for the original value. They may be used together. Neither word, by itself, establishes that a whole system is outside PCI scope.
Foundation · 2 min
Frequently asked questions
What is a payment token?
A payment token is a substitute identifier representing payment credentials in a particular service or network. Its use is constrained by that system. Protect it and the credentials that can use it, and do not assume it can be moved to another gateway.
Is storing a payment token the same as storing a card?
It is not the same data, but a token can still enable payment actions in its supported context. Treat access to it carefully. Whether token handling changes PCI scope depends on the system and ability to access underlying card data; obtain the appropriate assessment.