PCI Compliance
SwissPay.ai handles cardholder data within a PCI DSS Level 1 compliant environment, the highest level of the Payment Card Industry Data Security Standard.
Our PCI DSS status
SwissPay.ai is a PCI DSS Level 1 Service Provider (PCI DSS v4.0.1, AOC 2026). PCI DSS is the security standard set by the major card networks to protect cardholder data, and Level 1 is the most rigorous tier, covering the highest processing volumes.
How we protect card data
Card details are stored in SwissPay's tokenized card vault inside our PCI DSS Level 1 environment, so merchant systems handle tokens instead of card numbers. Data is encrypted in transit (TLS 1.2 or higher) and at rest, and in-scope systems require multi-factor authentication. We support 3-D Secure 2, frictionless and challenge, where required, and apply real-time fraud scoring.
Scope and shared responsibility
We maintain the security of the systems within our control and work with PayPal and processing providers that maintain their own PCI compliance. Security of cardholder data is a shared responsibility across the payment chain.
Merchant responsibilities
Merchants using our services are responsible for maintaining their own PCI compliance appropriate to how they accept payments, for keeping their integration secure, and for following the guidance we provide. Using a tokenized, hosted integration reduces the merchant's PCI scope.
Contact
For questions about our PCI compliance or to request documentation, reach us through support.swisspay.ai.
Last reviewed: 14 October 2026