A PCI compliant payment gateway from eCom Pay keeps card data out of your systems entirely, through hosted payment pages and tokenised card storage. Your transactions run through payment infrastructure assessed against PCI DSS, as every payment provider must be, and your own compliance workload shrinks to match what you actually handle, which is almost nothing.
24 hrs
approval, once documents are in
150+
currencies processed
4.4
Trustpilot rating
2010
processing payments since
On this page Why it matters · What is included · How it works · In depth · FAQs
PCI DSS is the security standard every business taking card payments must meet, and most merchants meet it the hard way. The smarter route is a PCI compliant payment gateway designed so card data never enters your world in the first place.
Check your approval oddsThe Payment Card Industry Data Security Standard applies to every business that takes card payments, however small. What varies is the burden, and the burden follows the card data. The less of it your systems touch, the lighter your obligations become.
Falling short of PCI DSS risks penalties, but a breach of stored card data costs far more, in remediation, in scheme consequences and in the customer trust that does not come back. The easiest card data to secure is the card data you never hold.
Self-assessment questionnaires, evidence gathering and annual reviews scale with your scope. Shrink the scope and the paperwork shrinks with it, which turns an annual dread into a manageable exercise.
Every part of the setup is designed around one principle. Card data that never reaches your systems is card data you never have to secure, store, audit or explain.
The payment form is hosted by the gateway, not your website, so card details are typed straight into secure infrastructure and never pass through your servers. Your checkout keeps your branding, your systems keep their innocence.
Saved cards live in a secure token vault, with your systems holding only tokens that are useless to anyone who steals them. Returning customers get one-tap checkout, and you get nothing sensitive to protect.
Strong customer authentication runs through the checkout and Pay by Link, keeping your payments aligned with UK and EU authentication rules and shifting fraud liability on authenticated transactions away from you.
Because card data stays off your systems, your PCI DSS self-assessment typically falls into the lightest categories, with far less evidence to gather and far fewer controls to demonstrate each year.
Your account manager and our team talk you through the self-assessment in plain terms, so an annual formality stays a formality instead of becoming a project.
Hosted, tokenised card security runs across the gateway, Pay by Link, the virtual terminal and recurring billing, so every channel you add inherits the same architecture automatically.
Fair. So here is what UK merchants say after switching to eCom Pay, in their own words.
It was such a pleasure working with eCom Pay for my company, very straightforward to set up and the team were so helpful. No hidden fees, cost efficient, and from using other platforms before I can say this has been the best so far.
Verified merchantvia Trustpilot
We found eCom Pay to be a simple, efficient payment system to integrate, with a lot of support behind it. Would recommend them over competitors who charge far too much.
Verified merchantvia Trustpilot
Great customer service from eCom Pay. Needed a card reader for my business, they had me set up fast and gave me better rates than the last company. Highly recommend.
Verified merchantvia Trustpilot
Super impressed with eCom Pay. The transaction fees are competitive, and I love that my customers have multiple payment options, which has noticeably improved my sales.
Verified merchantvia Trustpilot
Good service from eCom Pay. The card machines are reliable and easy to use. I like that there are no hidden fees and everything is explained upfront.
Verified merchantvia Trustpilot
Would highly recommend. Easy, simple, and always answers when I need help. The best payment gateway I have come across, with a wide variety of packages available.
Verified merchantvia Trustpilot
PCI DSS burden follows card data. This is how the setup moves that data, and the burden with it, away from your business step by step.
Hosted payment pages mean the card number is typed into secure gateway infrastructure, not your website. Your servers never see it, so the systems you run day to day fall outside the hardest requirements.
Tokenisation replaces stored card numbers with tokens. What sits in your database is a meaningless string, which is precisely what you want a thief to find.
3D Secure 2 verifies the customer with their bank during checkout, aligning you with strong customer authentication rules without adding friction for genuine customers.
With capture hosted and storage tokenised, your self-assessment typically lands in the lightest categories. Our team helps you complete it, and the same answers hold year after year because the architecture does not change.
Tokenisation has a full page of its own at payment tokenisation, and the wider security picture is covered in online fraud prevention.
The Payment Card Industry Data Security Standard, a set of security requirements that applies to every business taking card payments. It governs how card data must be captured, transmitted and stored, and the depth of your obligations depends on how much card data your systems actually touch.
Yes. Your transactions run through payment infrastructure assessed against PCI DSS, as every payment provider must be, and the whole setup is designed so card data is captured on hosted pages and stored as tokens, keeping it out of your systems entirely.
Yes, every card-taking business has PCI DSS obligations. What a well designed gateway changes is the size of them. With hosted payment pages and tokenised storage your scope shrinks to match what you actually handle, and your self-assessment typically falls into the lightest categories.
The form most merchants complete annually to demonstrate PCI DSS compliance, known as an SAQ. Which version you complete depends on how card data flows through your business. The less your systems touch, the shorter the form, which is exactly what hosted, tokenised card security is designed to achieve.
They move the point of capture off your website. The customer types their card number into the secure hosted form, styled with your branding, and your servers never receive it. Systems that never touch card data are systems you largely do not have to evidence.
It removes stored card data from your side entirely. Saved cards live in a secure vault, your database holds only tokens, and a breach of your systems would expose nothing usable. Less sensitive data means fewer requirements, less evidence and less risk, all at once.
Non-compliance can bring penalties, higher costs and, after a breach, serious scheme consequences on top of the damage itself. The practical answer is to make compliance easy by design, which is what an architecture that keeps card data away from you does.
Yes. Your account manager and our team walk you through the self-assessment in plain terms, help you understand which questionnaire applies and how the hosted, tokenised setup answers most of it. There is no setup fee to apply, and approval takes 24 hours once your documents are in.
Written by the eCom Pay team. Reviewed August 2026. Last updated August 2026.
Card data captured on hosted pages, stored as tokens and kept off your systems, approved in 24 hours once your documents are in.
See every capability on the features hub, or read about payment tokenisation.