Security by architecture,
not by promise.
Aventopay is built so that security is a structural property of the service — not a checklist. No compromise between convenience and protection.
PCI DSS Level 1 — SAQ-A scope
Card data never touches your servers or ours in the clear. It is tokenised directly on PCI DSS Level 1 certified infrastructure.
Card or wallet on the Aventopay page. Data tokenised, never stored by your site.
Funds are secured on infrastructure certified PCI DSS Level 1.
Direct payouts to the IBAN verified at activation.
Payment operations are executed by one or more licensed institutions within the European Union.
The pillars of Aventopay security
Strong Customer Authentication (SCA)
3D Secure applied automatically based on the cardholder's zone. Fraud liability shifted to the network. Chargeback becomes almost zero.
HMAC-SHA256 signatures
API Secret to sign your requests to Aventopay. Webhook Secret to sign our callbacks to you. Constant-time comparison, timing-attack prevention.
Idempotency & 8× / 12h retry
Every callback is retryable. Your handler never receives an event twice without knowing. The retry queue survives network failures.
Strict multi-tenant isolation
Every merchant has their own keys, credentials, webhooks. No leak possible between accounts in the database.
Complete audit trail
Every transaction, every account change, every callback attempt is logged. Exhaustive reporting via API and dashboard.
International reach
Visa, Mastercard, American Express, Apple Pay and Google Pay from around the world. SCA applied based on the payer's jurisdiction.
Security that protects your revenue
Compliance and security are not options — they are built into every transaction.