PCI Responsibility

1. How Paradox keeps card numbers away from everyone

Every card entry in Paradox — invoices, payment pages, the virtual terminal, signup — happens inside Fiserv's hosted CardSecure frame, served by Fiserv, not by us. The card number goes directly from your customer's browser to Fiserv, which hands back a token. Paradox stores and charges tokens only. Full card numbers never touch Paradox's servers, database, logs or backups — by architecture, not by policy.

2. What this means for your PCI scope

Because cardholder data entry is fully outsourced to a PCI DSS compliant provider, merchants using Paradox as designed typically qualify for the shortest self-assessment questionnaire, SAQ-A. Your acquirer or processor has the final word on your validation requirements — confirm with them.

3. Paradox's responsibilities

• /Serve the application exclusively over TLS.
• /Integrate card entry only through Fiserv's hosted tokenization frame.
• /Store no primary account numbers, ever; reject any input that looks like a raw card number typed where it shouldn't be.
• /Protect your gateway credentials with AES-256 encryption at rest and write-only handling.

4. Your responsibilities

• /Complete your own PCI attestation (typically SAQ-A) with your acquirer, on their schedule.
• /Protect your Paradox and CardPointe login credentials; remove teammates who leave.
• /Never write down, email or type full card numbers outside the secure entry frame — including into notes or custom fields.
• /Keep the devices and browsers you use for Paradox reasonably secure and up to date.
• /Follow your merchant agreement and card-network rules for the payments you accept.

5. Questions

If your acquirer's questionnaire asks something about Paradox you can't answer, send it over via the contact page and we'll give you the exact language.