PCI DSS
What is PCI DSS?
PCI DSS stands for Payment Card Industry Data Security Standard. It is a global information security standard designed to ensure that all companies that process, store or transmit credit card information maintain a secure environment.
Wallee is certified as a PCI DSS Level 1 Service Provider — the highest level in the payment card industry — validated through annual audits by a qualified PCI auditor.
Our platform is designed to ensure sensitive cardholder data never touches your servers, which significantly reduces your PCI scope.
How does it work?
We handle all sensitive data collection through our hosted integrations — the Payment Page, the iFrame or the Lightbox — so critical card data remains in our secure, certified environment and never reaches your systems.
Because of this, you only need to complete a Self-Assessment Questionnaire (SAQ-A) during your onboarding — a short 12-question form — rather than undergo costly audits or build complex infrastructure.
This only applies as long as your customers enter their card details on our infrastructure. If you use direct card processing, where the card number is entered in a form provided by you, the card data reaches your systems and the card schemes require additional security measures and a broader PCI certification from you. See Payments for an overview of the integration modes.
Data security practices
- End-to-end encryption is used on all sensitive information stored on data carriers.
- Decryption keys are stored separately, and no internal servers can access plaintext card data or customer configuration.
Certificate for your acquirer or bank
We provide access to our PCI DSS validation certificate on request — for example when your acquirer or bank asks for evidence of our compliance. Contact our support team to obtain it.