No card numbers
Card entry stays in the processor's hosted fields (Payroc Hosted Fields today). CardSecurity receives a payment token, the amount and the merchant, never the card number.
Security
Payment security software should be boring to audit.
The design rule is simple: CardSecurity never handles card numbers, and every decision and access change is recorded.
Locked-down payment pages
CardSecurity payment pages run under a strict content security policy. Every script they can load is inventoried with a reason and pinning method, and violation reports are collected.
Accounts
Two-factor authentication for every administrator, scoped roles per organization, expiring invitations and recovery that never widens access.
Audit trail
Charge approvals and rejections, access, security, integration and staff actions are recorded in each organization's activity history.
Staff access
CardSecurity staff use named accounts with mandatory two-factor authentication. Staff actions such as pausing a tenant are recorded, and there is no customer impersonation.
Payment integrity
Each payment attempt is claimed once. Unclear results are held for reconciliation and never resubmitted automatically.
Found a security issue? Email hello@cardsecurity.cc with the subject "Security report". Please don't test against live merchants' payment pages.
Protect your merchants' checkout before the next attack.
Join the CardSecurity pilot for managed service providers. 30-day trial, up to 5 merchants.