> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rntor.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PCI DSS compliance

> Review RNTOR’s payment-card security approach and learn how credit card data is protected

PCI DSS (Payment Card Industry Data Security Standard) is a global security standard created to protect cardholder data. PCI DSS standards specifically govern the protection of credit and debit card data and do not apply to ACH, SEPA, or other payment methods.

RNTOR uses a third-party service provider, such as Stripe, to manage and store sensitive payment data on behalf of customers. Here’s what this approach means and the steps you can take to determine and meet your own PCI compliance needs.

## RNTOR’s PCI compliance

RNTOR does not collect, store, or process sensitive account data, such as full card numbers or CVV/CVC. Cardholder data is managed exclusively by the third-party service provider (TPSP) or payment processor—for example, Stripe—that you choose to connect to RNTOR.

RNTOR securely stores only limited payment-method details returned by the processor, such as the card brand, expiration date, and last four digits of the Primary Account Number (PAN), so administrators and customers can identify a saved payment method without exposing the complete card number.

<Warning>
  Your organization’s PCI DSS validation requirements depend on its payment setup, transaction volume, and payment processor. Do not claim a specific PCI DSS certification or compliance level without a current supporting assessment or attestation.
</Warning>

## Determine your PCI compliance level

Identifying your transaction volume will help you understand your PCI DSS responsibilities. For many RNTOR customers, card payments are card-not-present transactions processed by a third-party service provider.

To determine and meet your PCI DSS obligations, follow the current guidance from your TPSP or payment processor:

* [Stripe PCI compliance](https://stripe.com/docs/security/guide)
* [PayPal PCI compliance](https://www.paypal.com/us/brc/article/pci-compliance)
* [Mercado Pago security](https://www.mercadopago.com.ar/developers/en/docs/security)

## Practical compliance steps

To further secure your payment environment with RNTOR, we recommend implementing the following measures:

* Limit access to payment data to essential personnel. [Adjust administrator permissions](/docs/admin/administration/administrators/permissions) to restrict customer and billing access on a need-to-know basis.
* Do not give administrator or owner roles to shared email accounts to prevent unauthorized access.
* Immediately remove users with administrator roles from the location if they leave your organization.
* Do not log in as an administrator on devices accessible to the public. Physically secure devices used to access RNTOR as an administrator.
* Never enter full card numbers or CVV/CVC values in notes, support tickets, custom fields, or messages.
* Add relevant payment-data retention and operational procedures to your [Terms of use](/docs/admin/general/terms-of-use) and [Privacy policy](/docs/admin/general/privacy-policy).

For more information about PCI compliance, visit the [PCI Security Standards Council website](https://www.pcisecuritystandards.org/).