Security
Security and compliance
How Sureway protects card data, and how to reach us about security.
Compliance
PCI DSS and SOC 2
PCI DSS v4.0.1
Sureway Payments is PCI DSS v4.0.1 compliant. Our Attestation of Compliance is shared on request.
SOC 2
Sureway Payments has a SOC 2 report from an independent auditor. It is shared with your security team on request, under NDA.
Card data
How cards are stored
- Cards are stored in a tokenized vault. Your platform stores the token, not the card number.
- Merchants moving from another provider can migrate their stored cards to Sureway.
- Card export to another PCI DSS compliant provider is available on request.
- All API traffic is encrypted in transit.
Review
Technical review and reporting
Technical review
Our security documentation is shared during technical review. If your security team wants to walk through it, write to us.
Report a security issue
If you believe you have found a vulnerability, email support@surewaypayments.com with "Security" in the subject. Please do not test against live merchant traffic.
Contact details are also published at /.well-known/security.txt.
Page last updated 5 October 2026.