Security & PCI Scope
How Tonder protects card data and which PCI scope falls on you for each integration model.
Tonder is PCI DSS Level 1 certified on AWS infrastructure. Your PCI scope depends on the integration mode you choose, and a few security practices protect your credentials and your customers.
PCI scope by mode
| Integration mode | PCI certification required |
|---|---|
| Hosted Checkout | None — Tonder hosts card capture |
| SDK (Full or Lite) | None — card data is tokenized on the client |
| Hybrid | None — cards flow through the SDK/Hosted leg |
| API Direct (S2S) — tokenized flow | SAQ A or SAQ A-EP — the card is tokenized before it reaches you |
| API Direct (S2S) — raw card data | PCI DSS Level 1 — the card passes through your servers |
With Hosted Checkout, the SDKs, or Hybrid, Tonder handles the card's PCI compliance. Only API Direct with raw card data requires PCI Level 1 certification.
How Tonder protects saved cards
Tonder's PCI Vault secures your customers' payment data through tokenization:
- Isolated network — card data is stored on a separate network and decryption keys are kept on distinct machines, with no system able to access it as plain text.
- Network tokenization — tokenization replaces sensitive card information with unique tokens during transmission over the network, reducing fraud risk on saved-card payments.
See Card payments for the tokenized flow in detail.
Authentication
Every request authenticates with the Authorization: Token YOUR_API_KEY header (the literal Token
scheme with a space, not Bearer). Also send X-Request-Id with a UUID v4 per request as the
idempotency key. See Authentication.
Security best practices
- Never expose your secret key in client code, mobile apps, or version control.
- Use HTTPS for all communications.
- Store credentials in environment variables — don't hardcode them.
- Rotate keys immediately if you suspect they're compromised.
- Use separate keys for sandbox and production.
- Restrict credential access on a need-to-know basis.
Webhooks
- Incoming webhooks: confirm them server-side by re-fetching the transaction or session status before trusting the payload. See Webhooks.