PatSaTECH builds and maintains payment gateway plugins and integrations that connect your store to your processor. We do not process card payments or store full card numbers on PatSaTECH servers when integrations use hosted fields, redirects, or tokens as designed.
For company background and citation-friendly facts, see About PatSaTECH and company facts.
Quick answer
PatSaTECH builds and maintains payment gateway plugins and integrations that connect your store to your processor. We do not process card payments or store full card numbers on PatSaTECH servers when integrations use hosted fields, redirects, or tokens as designed. PCI scope, admin access, API keys, and webhook monitoring stay with you—the merchant and your hosting team.
Our role
PatSaTECH is a software integrator (plugins, modules, custom checkout wiring)—not a payment processor, bank, or PCI QSA. Our products follow processor documentation for least-privilege API usage, sandbox testing guidance, and updates when gateway APIs or platform requirements change (per product changelog).
What merchants remain responsible for
- PCI DSS obligations that apply to your business, hosting, and checkout model (especially direct API integrations).
- Access control to WordPress / Magento / PrestaShop admin, SFTP, database, and API keys.
- Monitoring webhooks, logs, and order states for anomalies—see webhook monitoring for WooCommerce stores.
- Incident response on your infrastructure (WAF rules, malware, credential leaks).
For PCI scope language merchants can share internally: PCI scope in plain English.
How we reduce risk in software
- Sandbox-first documentation and product copy that discourage live keys before test matrices pass.
- Processor-aligned checkout flows (hosted, tokenized, or redirect) rather than inventing non-documented card handling.
- Maintained updates when APIs or WooCommerce HPOS/Blocks requirements change—verify per SKU on the product page.
- Scope boundaries in product copy (what the SKU does not cover—headless, marketplace splits, wrong processor variant).
Optional deeper trust links: WooCommerce hub · Documentation runbooks.
Reporting a security concern
Email [email protected] with Security in the subject line, the affected URL or product name, and steps to reproduce. For security topics, CC [email protected] so reports reach the product team quickly. We review legitimate reports and coordinate fixes as appropriate.
Do not send full card numbers, CVV, or live API secrets by email.
Key takeaways
- PatSaTECH integrates; your processor settles funds and holds the merchant relationship.
- Buying a plugin does not automatically PCI-certify your store—scope depends on checkout model and hosting.
- API keys and webhooks are production credentials; rotation and monitoring are operational requirements.
- Report vulnerabilities through a monitored channel with reproducible steps—not public social posts alone.
- Wrong-fit purchases are a commercial and security risk—use plugin vs custom before forcing the wrong SKU.
FAQ
Does PatSaTECH store customer card data?
Not when the integration uses processor-hosted or tokenized flows as documented. Confirm behavior on the specific product page for your version.
Are you PCI Level 1 certified as a service provider for my store?
We provide integration software. Your PCI obligations depend on your checkout architecture and processor—consult your QSA or processor compliance team.
Where is software hosted?
Plugins run on your site/server. PatSaTECH does not host your checkout.
Can you pen-test my store?
Scoped security assessments are not included with standard plugin licenses—request via get a quote if you need professional services.
