Skip to main content

​
PCI Compliance

PayRequest is a billing platform, not a card processor. Every payment method that involves a card — one-time payments and recurring mandates alike — is handled entirely by the connected payment provider (primarily Mollie, with Stripe, PayPal, and Payoneer available as alternatives). This is a deliberate architecture choice, not just a policy: it’s how the checkout code actually works.
PayRequest itself does not hold a PCI DSS certification. What follows describes the technical measures in place — Mollie, PayRequest’s primary processor, is PCI DSS Level 1 certified for the card data it handles on your behalf. Talk to your own compliance advisor about what this means for your specific business and jurisdiction.

​
How Card Data Actually Flows

1

Customer initiates payment

At checkout, PayRequest never renders a card number, expiry, or CVC input field — there is no such form anywhere in the product. Payment collection happens on the processor’s own hosted page.
2

PayRequest redirects to the processor

PayRequest creates a payment with Mollie (or Stripe/PayPal/Payoneer) and redirects the browser to the checkoutUrl / returnUrl returned by that provider’s API. The customer enters their card details directly on the provider’s hosted, PCI-compliant page — never on a PayRequest-controlled page.
3

The provider notifies PayRequest by webhook

Once payment completes, the provider sends a webhook with the payment status and a masked reference (e.g. a mandate ID or last-4 digits) — never the full card number.
4

PayRequest stores only the masked reference

For saved payment methods (mandates), PayRequest stores the provider’s mandate ID and the masked card summary it returns (card brand + last 4 digits) so customers can recognize their saved method — for example •••• 4242. The full card number and CVC are never transmitted to or stored by PayRequest at any point.

​
What This Means in Practice

​
Reducing Your Own Risk

Two-Factor Authentication

Add 2FA to your dashboard login to protect access to payment settings and customer data.

Audit Logs

Every account and payment-related action is logged with who, what, and when.

​
FAQ

PayRequest does not directly handle raw cardholder data — that happens on the payment processor’s infrastructure. This significantly reduces PayRequest’s own PCI scope, but PayRequest doesn’t claim its own PCI DSS certification. The certification applies to Mollie (and other connected processors) for the systems that actually touch card data.
A mandate/token reference and a masked summary (card brand and last 4 digits) returned by the processor — never the full PAN, expiry, or CVC.
Yes. Every supported card-capable processor is integrated through a redirect or hosted-checkout flow, so the same “PayRequest never touches raw card data” model applies regardless of which processor you connect.
See Saved Payment Methods for the full mandate lifecycle.