Company / Security and trust
Security and trustHow card data, merchant data, and money are protected
Payments buyers ask three questions: where does card data live, who can touch our account, and what happens when something breaks. These are the answers.
Compliance posture.
What is validated today, what is underway, and what is planned, each with its state shown plainly. Nothing here claims more than it holds.
Assessed annually by a Qualified Security Assessor as a Level 1 Service Provider, the highest validation tier. Attestation of Compliance available under NDA, and our service provider registry listing can be checked independently.
External scans every quarter by an Approved Scanning Vendor, as PCI DSS requires, alongside internal scanning.
Businesses and beneficial owners screened at onboarding and continuously afterwards, with escalation, case handling, and record retention that meets financial record-keeping rules.
Every merchant and agent application retains its documents, verification results, decisions, and the person or agent accountable for each one.
Security and availability controls tested across a period rather than on a single day.
Cadence, scope across API, portals, and network, retesting after significant change, and whether an executive summary can be shared.
Cyber liability and errors and omissions cover, with limits. Asked for by bank partners and enterprise procurement before architecture ever comes up.
International information security management certification.
States are reviewed each quarter. A claim moves to Active only when the evidence exists and can be shared.
Compliance programs.
Underwriting merchants and moving money brings obligations that outlast any single audit.
Screening of businesses and beneficial owners at onboarding and continuously afterwards, escalation and case handling, and record retention that meets financial record-keeping rules. Partners will want the program described, not just claimed.
Background checks before access is granted, security training on joining and annually, and access removed the day someone leaves. Most incidents start here rather than in the code.
How providers who touch merchant or cardholder data are assessed before onboarding and reviewed afterwards.
How card and merchant data is handled.
Practices rather than certificates, and the questions that come up in every security review.
Card details are tokenized on capture and held in the High Wire vault. Some processors share network tokens with us and some return their own reference instead, so we tell each merchant which applies to their processors. We are moving toward requesting network tokens ourselves, before a payment reaches any processor.
High Wire Checkout and Components keep card data off your servers. API checkout means card data passes through you, which changes which self-assessment questionnaire applies to your business. We will tell you which one before you build. See the detail Preview.
Encryption in transit and at rest, where keys live, who can reach them, and how often they rotate. Publish the standards rather than the word "encrypted".
Which providers process and store merchant and cardholder data, and what can be pinned to a region on request.
Scoped keys with separate sandbox and live credentials, key rotation without downtime, signed webhooks with replay protection, and rate limiting. The things an engineer checks before writing any code.
Which data AI agents can reach, what is logged for every decision, what requires human approval, and whether customer data is ever used to train models. Increasingly the first question enterprise reviewers ask.
What we keep, and for how long.
Payments records cannot simply be deleted on request. Anti-money-laundering and financial record-keeping rules require onboarding files, verification results, and transaction history to be retained for years after an account closes, and those obligations override a deletion request.
Cardholder data is processed on behalf of merchants, so requests from a cardholder come through the merchant under the agreement rather than directly to us. Merchants can export their own data at any time, and we say plainly what stays behind afterwards.
Access, availability, and what happens when something breaks.
Most security incidents in payments are not exotic. They are an old employee account, a shared password, or a webhook nobody was watching. The controls below are aimed at exactly that.
Ask us the hard questions.
Security reviews and questionnaires are answered by the team that runs the platform.