Transaction infrastructure
The processor and gateway are responsible for the systems used to encrypt card data, secure its transmission and support tokenization where stored-card functionality is provided.
PCI compliance is shared work, not a badge one company lends to another.
The processor and payment gateway carry the transaction infrastructure. The merchant still has obligations inside the business. Pcnaid is a referral partner: we are not a Qualified Security Assessor, and we do not complete anyone's Self-Assessment Questionnaire.
Who actually processes your payments
Processing partner
Hardware partner
Your merchant account is held with North (North American Bancard) or CardConnect CoPilot, and their acquiring sponsor bank moves your money. Pcnaid is an independent referral partner — we submit your application at the markup we publish and the processor decides it. We are not the processor, the bank, or an agent authorised to speak for either. The Clover Official Partner badge is displayed under our reseller agreement with Clover; Clover, North and Payanywhere are their owners’ trademarks, not ours.
What the processor and gateway provide
North American Bancard or CardConnect CoPilot, together with the relevant gateway and acquiring sponsor bank, provide the systems that authorize, route and settle transactions.
Processor-side compliance
The processor and its service providers maintain the security programs and assessments required for the infrastructure they operate. Any processor certification belongs to that organization, not to Pcnaid.
Risk and funding controls
The processor and its sponsor bank monitor account activity and control holds, reserves and funding decisions. Pcnaid cannot release funds or override a risk review.
What every merchant must maintain
Using a compliant processor does not make the merchant's own environment compliant. The business remains responsible for the way cards, devices, credentials and networks are handled on site.
Complete the applicable SAQ
Every merchant accepting cards must complete the Self-Assessment Questionnaire required for its acceptance method. The answers must describe the merchant's actual environment.
Protect the business environment
Staff handling of physical cards, password practices and the security of the local Wi-Fi network remain merchant responsibilities.
Respond to compliance requests
The merchant must work directly with the processor or its compliance provider when validation, remediation or supporting information is required.
What Pcnaid does — and does not do
We securely send application information onward to the processor's underwriting systems. We do not process transactions or touch cardholder data. Full Social Security numbers and full bank routing numbers are not permanently stored on our marketing or front-facing servers.
We are not a QSA or a PCI assessment firm. We do not inspect a merchant environment, certify compliance, choose answers for a merchant or complete an SAQ on anyone's behalf. We also do not claim our own SOC 2 or PCI certification for transaction processing, because we do not provide that processing.
Application security and payment security are different questions.
An application contains sensitive business, ownership and banking information used by underwriting. A payment transaction contains cardholder data handled by the processor's payment systems. Pcnaid's role is limited to the first path: transmitting the application onward. The processor's role covers the second.
No security control removes every risk. Merchants should follow the processor's current PCI instructions and answer compliance questions based on the systems actually used in their business.
Understand the responsibilities before applying.
The application goes to the processor for underwriting. Approval, final terms and ongoing risk controls remain the processor’s decisions.
Applying carries no obligation. Underwriting, approval and final rates are determined by the processor.
Not sure this is the right account? See every way to apply →