Compliance
Compliance overview
Updated 2026-09-24
Two design goals: raw card data should never touch your business, and the card networks should never surprise you. Most account closures in high-risk verticals come from the second one.
Integrity-risk registration
The card networks classify some verticals, including peptides, CBD, vape, adult, dating and pharmacy-adjacent models, as integrity-risk categories. Processing those categories requires the acquirer to register the merchant, assign the correct merchant category code, pay the program fees and monitor the merchant's site. Many processors skip the category rather than do this. We do it at onboarding: your account is registered and coded for what you actually sell, and the site review the program requires happens before you go live, not after a complaint.
Tokenization at capture
When a customer enters a card, it is tokenized at the point of capture. Your checkout, your CRM and your subscription logic only ever handle the token. The card number is not stored on, transmitted through, or visible to your systems, which keeps your own PCI DSS obligations small.
A vault under your name
Tokens, customer profiles and subscription schedules are held in a vault that is yours. Processors connect to the vault to run transactions; the vault does not belong to any one of them. Adding or replacing a processor is a routing change, your data can be exported at any time in a documented format, and a processor relationship ending does not end your ability to bill.
Transaction screening
Transactions are screened for fraud before they are routed, with rules tuned to your vertical rather than a generic default. 3-D Secure 2, the card networks' step-up verification, is available on your account and can be applied by rule, for example above a ticket size or for specific regions.
Routing, retries and redundancy
With more than one merchant account behind the vault, transactions are routed by card type, region, amount and recent processor performance. A soft decline (one the issuer would approve on a retry) can retry through an alternative route where the card network rules allow it. Every routing decision is recorded and visible in your dashboard.
Reserves and settlement
Settlement lands two business days after the transaction. Where a vertical requires a reserve, it is a rolling reserve with a stated release schedule, written into your offer before you sign, and reviewed as your history builds. There are no reserves that appear after the fact.
What you receive at onboarding
Compliance documentation for the vault and the processing infrastructure is provided during onboarding, together with the merchant agreement, the fee schedule and any reserve terms. If your own compliance, bank or auditor needs something specific, ask your named contact and we will source it before you sign.
What we do not do
- We do not collect card or bank details on this website. The application form asks for your business basics and contact details only.
- We do not run analytics or third-party scripts on this website.
- We do not onboard sites that carry health, dosing or outcome claims in regulated categories, products the card networks prohibit, or models that require third-party certification the merchant does not hold. Each industry page says what is not supported before you apply.
- We do not sell or share your application data. It goes to the processors we take your application to, and nowhere else.