Payment processing infrastructure: where Payneteasy runs and what the facilities provide

When a bank or PSP evaluates a payment gateway, the infrastructure question comes early: where does the platform run, and what stands behind that answer? Procurement, risk and IT teams need wording they can put into a vendor assessment without rewriting it later.

Here is ours.

Payneteasy processes payment data using data centers located in the European Union. Our core payment processing platform is hosted in colocation data centers located in the EU.

The rest of this article explains what that means in practice: what colocation is, what the facilities are designed for and which certifications they hold, and how this relates to Payneteasy’s own PCI DSS Level 1 status.

What colocation means for a payment platform

In a colocation model, Payneteasy runs its processing platform inside data centers operated by specialist facility operators. The operator is responsible for the building and its engineering systems: power supply, cooling, physical access control and on-site security. Payneteasy is responsible for the platform that runs there.

This split matters when you assess a provider. Two different sets of controls apply:

• Facility controls cover the physical environment: who can enter the building, how power and cooling are kept running, how the site is audited.
• Platform controls cover how payment data is handled in the software and processes: access to cardholder data, encryption, logging, change management.

Each set has its own certifications and audits. A useful vendor assessment keeps them apart, and so do we below.

What the facilities are designed for

Payneteasy processes payment data using data centers located in the European Union. Our core processing platform is hosted in colocation facilities designed to Tier III standards: they are concurrently maintainable, with N+1 redundancy for power and cooling, and are powered by 100% renewable energy. The facilities hold ISO/IEC 27001, ISO 9001, ISO 14001 and ISO 50001 certifications, maintain PCI DSS compliance for their physical infrastructure and are covered by independent SOC 2 and SOC 3 audit reports.

What these terms mean for a payment workload:

Tier III design. Tier III describes a data center design in which every power and cooling component can be taken out of service for maintenance without shutting down the equipment it supports. The facilities hosting our core platform are designed to Tier III standards.

Concurrently maintainable. Planned maintenance on the facility’s power and cooling systems — replacing a unit, servicing switchgear — can be carried out while the infrastructure keeps running. Facility maintenance does not, by itself, require switching off the equipment hosted there.

N+1 redundancy for power and cooling. For each set of components the facility needs to operate, there is at least one additional component in reserve. If one unit fails or is taken out for service, the reserve unit takes over the load.

100% renewable energy. The facilities are powered by 100% renewable energy, which is relevant for clients that report on the environmental footprint of their suppliers.

Facility certifications and audits

The certifications below belong to the facilities and their operators. Each of them is held by every facility that hosts our core processing platform.

For a payment provider, the most relevant entry is PCI DSS at the facility level. It covers the physical side of the standard — controlled access to the building and server areas, visitor procedures, monitoring — which a platform hosted in colocation relies on.

Payneteasy’s own certification: PCI DSS Level 1

Separately from the facilities, Payneteasy holds PCI DSS Level 1 certification. Our compliance is assessed against PCI DSS v4.0.1 by a Qualified Security Assessor (QSA) and confirmed by an Attestation of Compliance (AoC).

This is a different scope from the facility certifications above. The facilities’ PCI DSS compliance covers their physical infrastructure. Payneteasy’s PCI DSS Level 1 covers how our platform and our team store, process and transmit cardholder data. A complete picture for a vendor assessment includes both.

Why the wording matters

Banks and financial institutions increasingly record their ICT providers, and the details of the services those providers deliver, in their own registers and risk assessments. Whatever a provider publishes about its infrastructure can end up copied into those records.

For that reason, we describe our infrastructure in terms that hold for each facility and that we can document: data centers located in the European Union, Tier III design, the certifications the facilities hold, and our own PCI DSS Level 1 status — each attributed to the party that holds it.

How to verify

Security documentation, including our PCI DSS Attestation of Compliance, is available to clients on request.