Effective Date: May 19, 2026 | Last Updated: May 19, 2026
The protection of payment card data is a critical responsibility for PL Payments, Inc. ("PL Payments," "Company," "we," "our," or "us") and all merchants, partners, and third parties that participate in our payment ecosystem. As a registered ISO/MSP and Payment Facilitator, PL Payments is subject to the Payment Card Industry Data Security Standard (PCI DSS), the requirements of our sponsor bank, and the operating rules of the applicable card networks.
This policy establishes the framework under which PL Payments and its merchants are expected to handle, protect, and secure cardholder data and sensitive authentication data at all times.
The purpose of this policy is to outline PL Payments, Inc.'s commitment to protecting payment card information and maintaining compliance with all applicable PCI DSS requirements and related payment industry security obligations. This policy establishes the standards, expectations, and obligations that govern how cardholder data and sensitive authentication data must be handled across the PL Payments merchant ecosystem.
This policy applies to all PL Payments, Inc. personnel, systems, applications, platforms, merchants, vendors, contractors, and third-party service providers that may store, process, transmit, access, or otherwise impact the security of Cardholder Data (CHD) or Sensitive Authentication Data (SAD).
For the purposes of this policy:
PL Payments maintains a comprehensive security and compliance program that includes administrative, technical, and physical safeguards designed to protect cardholder data and sensitive authentication data in accordance with PCI DSS requirements. Our security program is reviewed and updated on an ongoing basis to reflect changes in applicable standards, technology, and the threat landscape.
Merchant Guidelines issued by PL Payments form part of contractual requirements and require merchants to maintain ongoing PCI DSS compliance, including the completion of applicable Self-Assessment Questionnaires (SAQs), Attestations of Compliance (AOCs), and any required network vulnerability scans. PL Payments reserves the right to request evidence of merchant PCI DSS compliance at any time, and noncompliance may result in corrective action up to and including termination of the merchant relationship.
Merchants processing payments through PL Payments are required to comply with all applicable laws, card network operating rules, sponsor bank requirements, processor requirements, anti-fraud obligations, underwriting standards, and industry security standards — including PCI DSS — at all times.
Merchants are solely responsible for ensuring that all systems, applications, devices, websites, integrations, or third-party services used in connection with their payment environment are appropriately secured and, where required, PCI DSS compliant. This responsibility extends to all components of a merchant's cardholder data environment (CDE), regardless of whether those components are operated directly by the merchant or by a third-party service provider engaged by the merchant.
Failure to maintain PCI DSS compliance may result in one or more of the following:
PL Payments strictly prohibits the unauthorized storage, transmission, disclosure, or misuse of Cardholder Data (CHD) and Sensitive Authentication Data (SAD) by merchants, employees, contractors, or third-party service providers.
Sensitive Authentication Data — including full magnetic stripe data or equivalent chip data, card verification codes (CVV2/CVC2/CID/dCVV), PINs, and PIN blocks — must not be stored following transaction authorization under any circumstances, except where expressly permitted under applicable card network rules or PCI DSS guidance for specific, limited use cases.
All payment data must be handled using secure technologies, encryption protocols, and access control mechanisms consistent with applicable PCI DSS requirements. Merchants must ensure that cardholder data is never transmitted over open, public networks without strong cryptographic protections, and must implement and maintain access controls that limit access to cardholder data to only those individuals whose job function requires such access.
Any suspected or confirmed security incident, unauthorized access attempt, compromise of payment information, or potential data breach involving cardholder data or sensitive authentication data must be reported immediately to PL Payments at Info@prolifepayments.com.
Merchants are expected to cooperate fully and promptly with any investigation, remediation effort, forensic review, sponsor bank request, or card network requirement arising from or related to a security incident. This cooperation obligation includes, without limitation, preserving evidence, engaging qualified forensic investigators, implementing required containment and remediation measures, and providing timely updates to PL Payments throughout the incident response process.
Failure to report a security incident in a timely manner or to cooperate fully with response efforts may result in financial liability, corrective action, or termination of the merchant relationship, in addition to any liability imposed by applicable law, card network rules, or sponsor bank requirements.
Merchants that utilize third-party payment gateways, integrations, plugins, hosted payment pages, hosting providers, software vendors, or any other third-party service providers in connection with their payment environment are solely responsible for ensuring that those providers maintain appropriate security controls and, where applicable, PCI DSS compliance.
Merchants must conduct appropriate due diligence before engaging third-party service providers that may have access to or impact the security of cardholder data or sensitive authentication data. Merchants must maintain written agreements with third-party service providers that include appropriate security and compliance obligations consistent with PCI DSS requirements, and must monitor the ongoing compliance of those providers throughout the relationship.
PL Payments reserves the right to request evidence of PCI DSS compliance from merchants or from service providers engaged by merchants at any time. The delegation of payment-related functions to a third party does not relieve the merchant of its compliance obligations under this policy or its merchant agreement with PL Payments.
This policy may be reviewed and updated periodically to reflect changes in applicable laws and regulations, payment industry requirements, sponsor bank expectations, card network operating rules, cybersecurity risks, or operational practices. Merchants and other covered parties are responsible for reviewing the current version of this policy on an ongoing basis.
Continued use of PL Payments' services following the publication of an updated version of this policy constitutes acknowledgment and acceptance of the most current version in effect. PL Payments will endeavor to provide notice of material changes through its merchant communications channels, though it is not obligated to provide advance notice of all updates.
PL Payments, Inc. is committed to maintaining a secure, compliant, and trustworthy payment ecosystem for merchants, consumers, financial institutions, and business partners. The obligations set forth in this policy are an integral part of that commitment and reflect PL Payments' belief that robust security practices are not merely a regulatory requirement — they are a foundational element of responsible business conduct in the payments industry.
PL Payments reserves the right to modify, amend, supplement, or replace this policy at any time and without prior notice. Updated versions of this policy become effective immediately upon publication to the PL Payments website or upon communication to affected parties. Continued use of PL Payments' services following any such modification constitutes acceptance of the revised policy guidelines.
This policy shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of law principles.
Questions or concerns regarding this policy may be directed to:
PL Payments, Inc.
Email: Info@prolifepayments.com