PCI DSS (Payment Card Industry Data Security Standard) is a global security standard created to protect cardholder data. PCI DSS standards specifically govern the protection of credit and debit card data and do not apply to ACH, SEPA, or other payment methods.
RNTOR uses a third-party service provider, such as Stripe, to manage and store sensitive payment data on behalf of customers. Here’s what this approach means and the steps you can take to determine and meet your own PCI compliance needs.
RNTOR’s PCI compliance
RNTOR does not collect, store, or process sensitive account data, such as full card numbers or CVV/CVC. Cardholder data is managed exclusively by the third-party service provider (TPSP) or payment processor—for example, Stripe—that you choose to connect to RNTOR.
RNTOR securely stores only limited payment-method details returned by the processor, such as the card brand, expiration date, and last four digits of the Primary Account Number (PAN), so administrators and customers can identify a saved payment method without exposing the complete card number.
Your organization’s PCI DSS validation requirements depend on its payment setup, transaction volume, and payment processor. Do not claim a specific PCI DSS certification or compliance level without a current supporting assessment or attestation.
Determine your PCI compliance level
Identifying your transaction volume will help you understand your PCI DSS responsibilities. For many RNTOR customers, card payments are card-not-present transactions processed by a third-party service provider.
To determine and meet your PCI DSS obligations, follow the current guidance from your TPSP or payment processor:
Practical compliance steps
To further secure your payment environment with RNTOR, we recommend implementing the following measures:
- Limit access to payment data to essential personnel. Adjust administrator permissions to restrict customer and billing access on a need-to-know basis.
- Do not give administrator or owner roles to shared email accounts to prevent unauthorized access.
- Immediately remove users with administrator roles from the location if they leave your organization.
- Do not log in as an administrator on devices accessible to the public. Physically secure devices used to access RNTOR as an administrator.
- Never enter full card numbers or CVV/CVC values in notes, support tickets, custom fields, or messages.
- Add relevant payment-data retention and operational procedures to your Terms of use and Privacy policy.
For more information about PCI compliance, visit the PCI Security Standards Council website. 
