AloraPay is built to PCI DSS Level 1 — the highest level of payment-card security. Here's what that means for your venue and your guests, without the acronym soup.
Numbers are replaced with secure tokens — they never sit on your devices or ours.
The same standard required of the world's largest payment processors.
Because we carry the heavy compliance load, your scope shrinks dramatically.
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security rules created by the major card networks — Visa, Mastercard, and others — that every business handling card payments must follow. It covers how card data is stored, processed, and transmitted.
In short: it's the industry rulebook that keeps card numbers safe. AloraPay handles the hard parts so you don't have to become a security expert.
PCI DSS has four levels, set by transaction volume. Level 1 is the most rigorous — reserved for the highest-volume processors and validated by an independent assessor every year.
Card data is protected end to end. Here's the chain in practice:
Because guests pay on their own phones and card data is tokenized before it reaches your devices, your venue's PCI scope is dramatically reduced. You don't store card data, so the bulk of compliance obligations sit with us and PowerTranz — not your floor.
No card machines to secure, no card numbers on receipts or back-office systems — a smaller attack surface and a simpler audit for you.
Need our Attestation of Compliance (AOC) or have a question from your acquirer? Our team can provide the paperwork.