Security
Card data stays where it belongs. With the processor.
LumniPay is designed so that raw card numbers never need to touch your servers or ours. Orchestration works on tokens, and every decision is logged.
Partner tokenisation
Card details are captured and tokenised by our PCI-compliant processing partners. Routing, retries and rebills use tokens, not card numbers.
Least-privilege access
Access to merchant configuration is restricted by role. Sensitive actions such as routing changes are attributable to a user.
Audit trail
Every routing decision, cascade attempt and rule change is logged, so you can explain any transaction after the fact.
Risk controls
Block rules, velocity limits and 3DS strategy help stop fraud before it becomes a chargeback.
Encrypted transport
All traffic to the platform and the public website is served over TLS.
Monitoring
Chargeback ratios and unusual decline patterns are surfaced per MID so issues are caught early.
Shared responsibility
What we handle, and what stays with you.
LumniPay and partners
- Card capture and tokenisation
- Routing and retry logic
- Platform access controls
- Risk tooling and alerts
Your business
- Strong passwords and 2FA for your team
- Accurate product and policy pages
- Fast, fair customer support
- Responding to disputes on time
Responsible disclosure
If you believe you have found a security issue affecting LumniPay, write to admin@lumnipay.com with the details and steps to reproduce. Please give us reasonable time to fix it before any public disclosure, and do not access or modify data that is not yours.
FAQ
Security and compliance.
Does LumniPay store card numbers?
No. Card data is entered into secure fields and tokenised by our processing partners. We keep only tokens and limited details such as the card brand and last four digits, used for routing, retries, subscriptions and support.
How is my data protected?
We use encryption in transit and at rest, hashed passwords, role-based access controls, network isolation and audit logging. Access to production systems is limited to authorised staff.
Is LumniPay GDPR and CCPA friendly?
Yes. We act as a processor or service provider for your customers' data and as a controller for our own website and account data. Our Privacy Policy explains the details, including international transfers and data subject rights.
Who is responsible for compliance with card network rules?
You are responsible for your products, marketing and customer experience, and must follow the rules of your processing partners and the card networks. LumniPay provides tools that make compliance easier, such as clear checkout disclosures and risk controls.
Who operates LumniPay?
LumniPay is operated by Lumnipay LLC, a limited liability company registered in Wyoming, USA. Company details are listed in our legal pages and in the website footer.