How we protect your data
Recivr calculates and reconciles payment fees. We handle transaction metadata, not cardholder data, and we design every service to keep customers' data separate and access minimal.
- No PANs, CVVs or other cardholder data, ever
- TLS on every connection, encrypted managed storage at rest
- Every request authorised against your organisation on the server
What crosses the boundary
What we read
- Interchange rate and fee designator
- Scheme, card product and funding source
- MCC, merchant and acquirer identifiers
- Amount, currency and region
- Authorization and clearing timestamps
Never accepted
- Primary Account Number (PAN)
- CVV and authentication data
- Cardholder name
- Expiry date
- Magnetic stripe and chip data
Transaction metadata only. Payment credentials never touch our systems, which is why there is no cardholder data to expose.
Our approach
The safest data is the data we never receive
To price a card transaction we need its economics: amount, currency, card product, region, merchant category and the routing that decides interchange. We do not need, and do not accept, the card number or anything that could be used to make a payment.
What we do hold is commercially sensitive: your fees, your volumes and your merchants' economics. So the platform is built to keep each customer's data separate, to give people and services only the access they need, and to keep a complete record of every transaction event we receive.
Controls
Security controls.
The controls that apply to your data from the moment it reaches us.
No cardholder data
We never receive full card numbers, CVVs or other authentication data. We work with transaction metadata: amounts, currencies, card product, region and fee outcomes.
Encrypted in transit and at rest
All traffic is served over TLS, including connections between our services and to our databases. Stored data sits on encrypted managed storage.
Tenant isolation
Every request is authenticated and authorised against your organisation and entity. Access is checked on the server for each call, so one customer cannot read another's data.
Least-privilege access
Internal tools sit behind identity-based access. Services use separate credentials per role, and secrets are never stored in code.
Raw and derived data kept apart
Raw transaction events are archived separately from the aggregates behind reporting, so analytics are always re-derivable from source.
Monitored around the clock
Availability, latency and error rates are monitored continuously, with alerting to the engineering team.
Scope
A note on PCI DSS
PCI DSS applies to organisations that store, process or transmit cardholder data — Primary Account Numbers (PANs), CVVs and other sensitive authentication data.
Recivr does not handle cardholder data. We work with transaction metadata: fee calculations, interchange rates, scheme costs and aggregated analytics, so PCI DSS certification does not apply to Recivr.
Architecture
Data architecture.
Raw events and the aggregates built from them are stored and controlled separately.
Layer 1
Event archive
Every transaction event, exactly as it was received.
- Written by the ingestion pipeline, not by people
- Kept separate from the reporting databases
- The source every report can be rebuilt from
- Encrypted at rest
Layer 2
Reporting and reconciliation
The aggregates behind analytics, invoices and clearing matches.
- Scoped to your organisation and entity on every query
- Access checked on the server, per request
- Served over TLS to the dashboard and API
- Re-derivable from the event archive at any time
Scope of processing
Data we handle
Recivr handles transaction metadata and fee-related information — not cardholder data. Transaction events are retained to power reconciliation and reporting, scoped to your organisation, for the period set out in your agreement.
- Interchange fee calculations (IC++)
- Scheme fee breakdowns (Visa and Mastercard)
- Transaction volume and value analytics
- Merchant and acquirer identifiers
- Scheme invoice and billing line records
- Clearing and interchange report records
- Acquirer and processor fee schedules
- Cross-border transaction metadata
Infrastructure
Infrastructure security
UK and EU hosting
The platform runs in London and Amsterdam on managed cloud infrastructure, with both regions serving traffic.
Managed, encrypted databases
Data is stored in managed databases on encrypted storage, reachable only over TLS and only from trusted sources.
Secrets and credentials
Secrets live in the platform's secret stores, never in code. Services authenticate to each other with per-service credentials.
Protected at the edge
Public traffic enters through Cloudflare, with TLS termination, DDoS protection and bot management in front of every service.
Compliance
Compliance
We can provide security questionnaire responses and architecture documentation on request.
UK and EU GDPR
Personal data is processed in line with UK and EU data protection law
Data Processing Agreement
Provided to every customer
PCI DSS
Not applicable: we do not store, process or transmit cardholder data
Questions about security?
Ask us for our security questionnaire responses or architecture documentation, or talk to our engineers.