Security & compliance
Security you don't have to think about.
Bank-grade protection and South African compliance built into every payment.
PCI DSS
Card data is processed in a PCI DSS compliant environment. Using our hosted page keeps your PCI scope to a minimum.
FICA
We verify every merchant under the Financial Intelligence Centre Act to keep the ecosystem safe.
POPIA
Personal information is processed lawfully and minimally, in line with the Protection of Personal Information Act.
3-D Secure
Cardholder authentication on every eligible card payment shifts fraud liability and protects customers.
Hosted payment page
Card data never touches your systems
Your site only ever handles a session ID and a result. Sensitive card details go straight from the customer's browser to SupaPay.
Your website
Creates a session, no card data
SupaPay hosted page
Captures card + 3DS securely
Card networks
Authorise the payment
Your website
Receives result + webhook