We never see a full card number.
Card details are typed into fields hosted by Stripe, a PCI DSS Level 1 service provider, and go straight to Stripe. What reaches Zonipay is a reference to the card, never the number itself. This page sets out how we protect the rest: accounts, orders and the people behind them.
Who holds what at checkout.
The hosted checkout is ours, on your subdomain. The card number, expiry and security code fields inside it are Stripe's.
Types the card into the payment fields
- Card numbertyped
- Expiry, security codetyped
- Attestationticked
Receives and stores the card details, runs the authorisation
- Full card numberheld by Stripe
- Security codenever stored
- 3-D Securewhen the issuer asks
Receives the result and a reference
- Card brand, last 4 digitsfor receipts
- Payment statuspaid or declined
- Attestation recordstored with order
The rest of the stack.
Encryption in transit
Every page, API call and webhook uses TLS. The hosted checkout on your subdomain is served only over HTTPS, and the compliance scanner checks that your storefront and checkout certificates are valid on every pass.
Webhooks are signed with HMAC-SHA256 so your server can confirm a message came from us and was not altered.
Encryption at rest
Databases, backups and stored files, including the onboarding documents you upload, are encrypted at rest.
Access control and two-factor authentication
Staff get access to production systems and merchant data only where their role needs it, and that access is reviewed and removed when roles change. Two-factor authentication is required for staff accounts and for merchant dashboard users.
Merchants can roll their API keys and webhook signing secrets from the dashboard at any time.
Fraud screening and 3-D Secure
Every payment is screened before authorisation, and orders can be blocked by buyer, card or region where sales are restricted. 3-D Secure is applied when the card issuer requests it, which moves the liability for many fraud disputes away from the seller.
Merchants are screened too: at review, every business and its owners are verified, and storefronts are scanned before the first sale and every 8 hours after.
Data retention
We keep transaction records, attestation records and verification documents for as long as financial, tax and anti-money-laundering rules require, then delete them. Scan evidence is archived for each scan so a finding can always be traced to what the page showed at the time.
What we collect and how long we keep it is set out in the privacy policy. Requests about personal data go to privacy@zonipay.com.
What we do not claim
This page lists the controls we run. It does not list certifications or audit reports we do not hold, and we will not suggest otherwise. Card data security rests on Stripe's fields, as described above.
Found something? Tell us first.
If you believe you have found a vulnerability in zonipay.com, the hosted checkout, the API or the dashboard, email us with enough detail to reproduce it.
security@zonipay.com- We acknowledge your report and keep you informed while we investigate and fix.
- We will not take legal action against research done in good faith under these guidelines.
- Use test accounts and the sandbox. Do not access, change or delete data that is not yours.
- No denial-of-service testing, spam, social engineering or physical attacks.
- Give us reasonable time to fix the issue before you disclose it publicly.
Documents on request.
Partners, banks and merchants running their own review can ask for the documents below. Some are shared under a confidentiality agreement.
Ask at security@zonipay.com or compliance@zonipay.com, Monday to Friday, 9:00 to 18:00 ET.