Card data never reaches your servers. Drop-in card fields capture the card inside Paydude's environment and return a token, which is what keeps your PCI obligation at the shortest self-assessment level instead of the full standard.
Tokenization
A token is a reference with no mathematical relationship to the card number — unlike encryption, there is nothing to decrypt. It can only be charged through your Paydude account, so it has no value to anyone who obtains it.
That is what makes recurring billing possible without ever holding card details. See what is tokenization for the mechanics.
What this does to your PCI scope
| Approach | SAQ | Roughly |
|---|---|---|
| Card data captured in Paydude's fields | SAQ A | ~20 questions |
| Your page controls the form but does not receive card data | SAQ A-EP | ~140 questions |
| Card data touches your servers | SAQ D | 300+ questions |
The jump from SAQ A to SAQ D is not incremental — it brings network segmentation, quarterly scanning, penetration testing and formal access control. Keeping card numbers out of your systems is worth more than any control you could add afterwards. See what is PCI compliance.
Fraud and authentication
- Risk scoring on every payment, rather than blanket rules.
- 3D Secure step-up applied when signals warrant it — selective rather than universal, so conversion is not paid away on low-risk transactions.
- Encryption at rest for stored data.
- Signed webhooks, so a forged event cannot be mistaken for a real one.
- Idempotent writes, so a retried request cannot charge twice.
What remains yours
Completing your own PCI self-assessment and attestation. Preserving the architecture that earned the reduced scope. And everything that is not payments — your data protection obligations, your terms, your privacy practices and your own infrastructure security.
Paydude moves the card-data burden off your side of the line. It does not make you compliant by itself, and any provider claiming otherwise is overselling.
GOOD QUESTIONS
Frequently asked
Is Paydude PCI compliant?+
Paydude runs PCI-compliant infrastructure and card data is tokenized end to end. Because drop-in card fields capture the card inside Paydude's environment, card numbers never reach your servers — which keeps your own PCI obligation at the shortest self-assessment level rather than the full standard.
Does Paydude store my customers' card numbers?+
Card data is held inside Paydude's PCI-scoped environment. What you store is a token — a reference with no mathematical relationship to the card number, and no value to anyone outside your Paydude account.
Does Paydude support 3D Secure?+
Yes. Risk scoring runs on every payment, with 3D Secure step-up authentication applied when the signals warrant it rather than on every transaction, which protects conversion while shifting fraud liability where it matters.
What compliance work is still mine?+
Completing the appropriate PCI self-assessment questionnaire, keeping the architectural choices that earned the reduced scope, and everything outside payments — your own data protection obligations, terms and privacy practices. Using Paydude reduces the burden substantially but does not remove it.