Security & Compliance

Hosted checkout is designed to keep card data away from your stack, so your integration can stay lightweight.

PCI DSS scope

Card data is entered exclusively on BINKPAY-hosted checkout pages. If you integrate via Hosted Checkout or Payment Links and never touch raw card numbers in your own code, your PCI scope is the minimal SAQ A — you never see, transmit, or store cardholder data.

BINKPAY does not yet hold PCI DSS, ISO 27001 or SOC 2 certification and has not been externally audited. Card data is tokenised, and card processing will run through licensed, certified partners.

Encryption

• In transit — TLS 1.2+ on every API and checkout connection.
• At rest — sensitive fields (API keys, tokens) are encrypted at the storage layer; secret keys are shown once and masked thereafter.

Data handling

We retain payment and customer records for the duration required by applicable financial regulation in your operating jurisdiction, and never share data across merchant accounts.

For our security documentation or a vendor security questionnaire, contact

Support