Your website takes the payment. We handle the card data.

With Paytia's web payments, a customer fills in their card details on a payment form that sits on your website. The key difference from a basic payment form is that the card entry fields are served inside a Paytia iframe — hosted in our PCI DSS Level 1 environment, not on your server. The data goes straight from that iframe to your payment gateway. Your web server only ever sees a transaction reference; it never handles the card numbers themselves.

Yes. We're a certified PCI DSS Level 1 service provider, which is the highest certification level. Because card data is captured in our environment and transmitted directly to the gateway, your servers stay out of the card data flow — which significantly reduces your own PCI scope. You'll still need to complete a self-assessment questionnaire, but the scope is much narrower than if you were handling card data directly.

The card number, expiry date, and CVV are entered into fields that are rendered by Paytia's servers inside an iframe on your page. Even though it looks like part of your website, that content is served from our secure environment. Your web server doesn't receive the keystrokes, can't log the values, and isn't in the transmission path to the gateway. That's the protection the iframe model gives you.

3D Secure 2 (3DS2), address verification (AVS), CVV matching, and velocity checks are all included as standard. 3DS2 handles authentication for higher-risk transactions while letting through low-risk ones without any extra steps for the customer. We don't charge separately for these — they're part of how the system works.

Yes — there are three ways to integrate. You can embed the payment form using a snippet of code (iframe embed), redirect customers to a Paytia-hosted payment page, or use our REST API for full programmatic control. Most development teams have a working integration in a day. If you're not sure which approach suits your stack, we can talk you through it.

We work with most major UK and international gateways including Stripe, Barclaycard, Adyen, and Worldpay. We're gateway-agnostic by design — if you've already got a gateway relationship you're happy with, we connect to it rather than replacing it. This also means if you ever switch gateway, you don't have to rebuild your payment integration.

Yes. We tokenise the card on first payment — storing a secure token rather than the card number. That token can be used to process future payments without the customer having to re-enter their details. It works for subscriptions, instalment plans, or any repeat purchase model where the customer has consented to future charges.

The main cost driver in PCI compliance is the scope of your cardholder data environment — the systems that touch card data. Because our iframe approach keeps card data off your servers entirely, your scope shrinks considerably. That typically means a shorter, simpler self-assessment questionnaire and less time spent preparing for audits. For businesses that were previously handling card data directly, the difference can be substantial.