We are not a PCI processor. Your processor handles cardholder data; we handle scoring metadata. Your PCI obligations stay with your processor.
What this is
PCI DSS (Payment Card Industry Data Security Standard) governs how cardholder data is stored and transmitted. We are intentionally out of PCI scope. Card numbers go from the shopper to Shopify, Stripe, or Square — not to us. We only see scoring metadata for Keep / Review / Stop: never the card number, never the CVV, never the full magnetic stripe.
Steps
What stays with your processor
- Cardholder Primary Account Number (PAN) — never reaches us.
- CVV / CVC — never reaches us.
- Track / magnetic stripe data — never reaches us.
- PIN data — never reaches us.
Your processor (Stripe, Square, etc.) handles all of the above and bears the PCI compliance scope for them.
What we receive
- Charge amount, currency, timestamp.
- Customer email + customer ID (processor's tokenized handle).
- IP address, user agent, device fingerprint.
- Billing + shipping address (when present).
- The first 6 / last 4 digits of the PAN (BIN range — used for issuer identification, not stored as full PAN).
Common issues
- Your auditor wants to know if we're a PCI processor → No. We are out of scope by design. Email [email protected] for a written reply.
- Your auditor wants a PCI ROC from us → We don't have one because we're not a PCI processor. A written out-of-scope reply from compliance@ is the right artifact.
- You're a Level 1 merchant doing your own ROC → List us under "fraud detection (no cardholder data)" and attach the compliance@ reply.
- You're getting card numbers in your dashboard somehow → That would be a serious bug. Email [email protected] immediately with a sanitized screenshot.
What "done" looks like
You've added VerifyLive to your service-provider inventory under "fraud detection (no cardholder data)" and have a written out-of-scope reply from compliance@ if the auditor asked. We are not a PCI processor, so there is no SAQ-D from us.
Need more help?
PCI questions go to [email protected] for documented response. Open chat for general questions only. See also: