PCI Compliance

Last updated: October 2026

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for any business that accepts card payments. This page explains how Kinetic Pay is designed to reduce your PCI scope and what you remain responsible for.

1. Card payments are processed by Stripe

Card payments in Kinetic Pay are processed by Stripe, a PCI DSS Level 1 certified provider — the highest level of certification in the payments industry.

Card numbers are entered into Stripe-provided fields and sent directly to Stripe. Kinetic Pay servers receive only tokens and limited, non-sensitive details (such as card brand and last four digits). We never store full card numbers or security codes.

2. What this means for your business

Because sensitive card data does not pass through or get stored on Kinetic Pay systems, your PCI scope is typically reduced. Many merchants in this setup qualify for a simpler Self-Assessment Questionnaire (often SAQ A), but your card brand or acquirer determines what applies to you.

3. Your responsibilities

Never write down, email, or type full card numbers into notes, invoices, customer records or messages.

Keep the devices and browsers you use for Kinetic Pay updated, use strong unique passwords, and give each employee their own PIN.

Remove access promptly for employees who leave, and limit roles to what each person needs.

Complete any annual PCI validation your payment processor requests.

4. Our safeguards

We encrypt traffic with TLS, hash passwords with bcrypt, use httpOnly session cookies, enforce role-based access and encrypt saved bank details with AES-256-GCM. Learn more on our Security page.