Payment-platform compliance

Duoza’s platform is a PCI DSS v4.0.1 Level 1 Service Provider and is listed on the Visa Global Registry of Service Providers as a Merchant Servicer.

The annual reassessment for the 2026–27 cycle is in progress. Current compliance documentation and service-scope information are available through your Duoza contact during partner and merchant onboarding.

Match responsibilities to your integration

Security responsibilities follow the payment channel and data flow. Hosted checkout, iframe, Direct Pay API, and POS involve different merchant environments and handling responsibilities.

Your onboarding package covers the applicable data-flow and security requirements. Review your merchant PCI obligations and assign owners for access administration and incident coordination.

Build security into launch readiness

  • Use the approved integration and credential-handling guidance for your channel.
  • Give access only to the people who need it and keep a named credential owner.
  • Keep sensitive cardholder data out of application logs and ordinary support messages.
  • Test the complete payment journey, including 3-D Secure and interrupted attempts.

Protect information throughout operations

Use approved channels for onboarding documents and operational evidence. Collect only the information needed for the task and apply your retention and access policies.

For regulatory responsibilities, see the licensing guide. The acquiring bank holds the acquiring licence and scheme membership, while Duoza runs the payment platform.