# Paydude security and compliance

URL: https://www.paydude.io/resources/paydude-security-and-compliance
Type: Guide
Published: 2026-09-05 · Updated: 2026-09-05
Summary: How Paydude handles card data: tokenization, PCI-compliant infrastructure, 3D Secure and signed webhooks — plus what compliance work remains yours.

**Card data never reaches your servers.** Drop-in card fields capture the card inside Paydude's environment and return a token, which is what keeps your PCI obligation at the shortest self-assessment level instead of the full standard.

## Summary

Your database stores a token, never a card number. PCI-compliant infrastructure, with card data held in Paydude's scope. Risk scoring on every payment, with 3D Secure applied selectively. Signed webhooks and idempotent writes prevent replay and duplicate charges.

## Tokenization

A token is a reference with no mathematical relationship to the card number — unlike encryption, there is nothing to decrypt. It can only be charged through your Paydude account, so it has no value to anyone who obtains it.

That is what makes recurring billing possible without ever holding card details. See [what is tokenization](https://www.paydude.io/resources/what-is-tokenization) for the mechanics.

## What this does to your PCI scope

**Why the integration choice is the compliance choice**

| Approach | SAQ | Roughly |
| --- | --- | --- |
| Card data captured in Paydude's fields | SAQ A | ~20 questions |
| Your page controls the form but does not receive card data | SAQ A-EP | ~140 questions |
| Card data touches your servers | SAQ D | 300+ questions |

The jump from SAQ A to SAQ D is not incremental — it brings network segmentation, quarterly scanning, penetration testing and formal access control. Keeping card numbers out of your systems is worth more than any control you could add afterwards. See [what is PCI compliance](https://www.paydude.io/resources/what-is-pci-compliance).

## Fraud and authentication

- **Risk scoring on every payment**, rather than blanket rules.
- **3D Secure step-up** applied when signals warrant it — selective rather than universal, so conversion is not paid away on low-risk transactions.
- **Encryption at rest** for stored data.
- **Signed webhooks**, so a forged event cannot be mistaken for a real one.
- **Idempotent writes**, so a retried request cannot charge twice.

> **Things that quietly expand your scope:** Taking card details over the phone into your own system, accepting card numbers by email or chat, or logging request bodies that contain them will all move you from SAQ A to SAQ D regardless of how the platform is configured. The reduced scope is something you maintain, not something you are given once.

## What remains yours

Completing your own PCI self-assessment and attestation. Preserving the architecture that earned the reduced scope. And everything that is not payments — your data protection obligations, your terms, your privacy practices and your own infrastructure security.

Paydude moves the card-data burden off your side of the line. It does not make you compliant by itself, and any provider claiming otherwise is overselling.

**See how the integration works** Drop-in fields, tokenization and signed webhooks. — [API overview](https://www.paydude.io/resources/paydude-api-overview)

## Frequently asked questions

### Is Paydude PCI compliant?

Paydude runs PCI-compliant infrastructure and card data is tokenized end to end. Because drop-in card fields capture the card inside Paydude's environment, card numbers never reach your servers — which keeps your own PCI obligation at the shortest self-assessment level rather than the full standard.

### Does Paydude store my customers' card numbers?

Card data is held inside Paydude's PCI-scoped environment. What you store is a token — a reference with no mathematical relationship to the card number, and no value to anyone outside your Paydude account.

### Does Paydude support 3D Secure?

Yes. Risk scoring runs on every payment, with 3D Secure step-up authentication applied when the signals warrant it rather than on every transaction, which protects conversion while shifting fraud liability where it matters.

### What compliance work is still mine?

Completing the appropriate PCI self-assessment questionnaire, keeping the architectural choices that earned the reduced scope, and everything outside payments — your own data protection obligations, terms and privacy practices. Using Paydude reduces the burden substantially but does not remove it.