> For the complete documentation index, see [llms.txt](https://wallee.gitbook.io/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wallee.gitbook.io/documentation/payments/overview/transaction-states/pci-dss.md).

# PCI DSS

### What is PCI DSS?

PCI DSS stands for Payment Card Industry Data Security Standard. It is a global information security standard designed to ensure that all companies that process, store or transmit credit card information maintain a secure environment.

**{inject-brand-name} is certified as a PCI DSS Level 1 Service Provider** — the highest level in the payment card industry — validated through annual audits by a qualified PCI auditor.

Our platform is designed to **ensure sensitive cardholder data never touches your servers**, which significantly reduces your PCI scope.

### How does it work?

We handle all sensitive data collection through our hosted integrations — the [Payment Page](/documentation/payments/integrations/integrations/wallee-payment-page.md), the [iFrame](/documentation/payments/integrations/integrations/iframe-integration.md) or the Lightbox — so critical card data remains in our secure, certified environment and never reaches your systems.

Because of this, you only need to complete a **Self-Assessment Questionnaire (SAQ-A)** during your onboarding — a short 12-question form — rather than undergo costly audits or build complex infrastructure.

{% hint style="warning" %}
This only applies as long as your customers enter their card details on our infrastructure. If you use **direct card processing**, where the card number is entered in a form provided by you, the card data reaches your systems and the card schemes require additional security measures and a broader PCI certification from you. See [Payments](/documentation/payments.md) for an overview of the integration modes.
{% endhint %}

### Data security practices

* **End-to-end encryption** is used on all sensitive information stored on data carriers.
* Decryption keys are stored separately, and no internal servers can access plaintext card data or customer configuration.

### Certificate for your acquirer or bank

We provide access to our **PCI DSS validation certificate** on request — for example when your acquirer or bank asks for evidence of our compliance. Contact our [support team](https://wallee.com/ueber-wallee/support) to obtain it.