Your cardholders' data, protected at every layer
Payerbee is a PCI DSS v4 service provider and processes cardholder data under GDPR on your bank's instructions. Encryption, access control and monitoring cover everything we run.
Held to the card industry's own security standard
PCI DSS is the standard Visa and Mastercard require of everyone who handles card data. Payerbee is a PCI DSS v4 service provider and validates its compliance every year with a signed Attestation of Compliance.
Our Attestation of Compliance is available to your bank on request.
- Card numbers kept apart
- Full card numbers are handled only in Payerbee's separate cardholder data environment. There they are tokenized with Visa and Mastercard as soon as they arrive, then permanently deleted, so Engagement Studio never holds one.
- Hosted in the EU
- Engagement Studio is hosted in the EU, on private networks, and its data is backed up.
- Encryption
- Data is encrypted in transit and at rest, including every file exchanged with your bank.
- Access control
- Your users sign in with two-factor authentication and see only what their role allows. Our own staff get the least access their work needs.
- Monitoring and response
- Our systems are monitored around the clock, and we have a tested plan for responding to incidents.
Your bank stays in control of its cardholders' data
Under GDPR your bank is the controller and Payerbee the processor. A data processing agreement between us sets out what we process, why, for how long and with which safeguards.
Your bank decides
- Why cardholder data is used, and on which legal basis, such as legitimate interest or marketing consent
- Which cardholders a campaign reaches, and what it offers them
- Who at the bank works in Engagement Studio, and with which role
Payerbee carries it out
- Processes cardholder data only on your instructions
- Uses only the transaction and cardholder data a campaign needs
- Hosts it in the EU
- Helps you answer cardholders' requests for access, correction or erasure
- Lets cardholders opt out of messages at any time
- Tells your bank without undue delay of any personal data breach
Questions about security
Does Engagement Studio hold card numbers?
No. Full card numbers are handled only in a separate cardholder data environment, where they are tokenized with Visa and Mastercard as they arrive and then permanently deleted.
Where is our data hosted?
In the EU, on private networks. It is encrypted in transit and at rest, and backed up.
Who decides how cardholder data is used?
Your bank does. Under GDPR you are the controller and Payerbee the processor, and a data processing agreement sets out what we process, why and for how long.
Something we have not answered?
Contact us with any more questions. We are happy to go through them with you.
