Elixirpay's PCI DSS Compliance.
Effective Date: July 1, 2026
Elixir Pay processes card payments on behalf of thousands of businesses, which means the
security of cardholder data is one of our highest priorities. This page explains our
compliance with the Payment Card Industry Data Security Standard (PCI DSS).
1. What is PCI DSS
PCI DSS is a global security standard created by the major card networks — Visa, Mastercard,
American Express, Discover, and JCB — that defines the technical and operational requirements
for any organization that stores, processes, or transmits cardholder data.
2. Our Certification
Elixir Pay is validated as a PCI DSS Level 1 Service Provider, the highest level of
certification, reserved for providers processing the largest volumes of card transactions. Our
compliance is assessed annually by a Qualified Security Assessor (QSA) and validated through
an Attestation of Compliance (AOC).
3. How We Protect Card Data
- Card data is encrypted in transit using TLS and encrypted at rest where retained
- Cardholder data environments are logically segmented from the rest of our infrastructure
- Access to systems that touch card data is restricted and logged on a least-privilege basis
- Systems are continuously scanned for vulnerabilities and penetration tested regularly
4. Tokenization
Wherever possible, raw card numbers are replaced with a non-reversible token immediately at
the point of entry. Merchants and their systems interact with this token rather than the
underlying card number, which significantly reduces the scope of card data that ever needs to
touch a merchant's own systems — and their own PCI DSS obligations as a result.
5. Merchant Responsibilities
Using Elixir Pay's hosted checkout, tokenization, and APIs as intended significantly reduces
your own PCI DSS scope, since raw card data never needs to touch your servers. If your
integration captures or stores card data directly rather than through our hosted or tokenized
flows, you take on additional PCI DSS obligations of your own — our integration team can help
you choose an approach that minimizes this scope.
6. Annual Validation
Our PCI DSS compliance is re-validated every year, alongside continuous internal monitoring
throughout the year. Our current Attestation of Compliance is available to enterprise
merchants and partners on request through our compliance team.
Contact Us