Is Hostaway PCI DSS Compliant?
Answer
Yes. Hostaway is a validated PCI DSS v4.0.1 Level 1 Service Provider.
PCI DSS (Payment Card Industry Data Security Standard) is the global security standard for any company that stores, processes, or transmits payment card data. Level 1 is the highest validation level for service providers. It requires a full assessment by an independent Qualified Security Assessor, documented in a Report on Compliance and an Attestation of Compliance.
What This Means for You
You don’t need to do anything. Hostaway runs these security controls every day, and they apply automatically to every guest payment you process through Hostaway with your connected payment processor.
You may notice some of these controls in your account:
- Restricted cardholder details: Sensitive cardholder details are restricted between Hostaway and your payment processor. For example, the cardholder’s name is not shown on your Hostaway dashboard. You can see it in your Stripe or Authorize.net account. More details in Guest Payments: Frequently Asked Questions.
- Stored cards stay with your processor account: Saved cards and Stripe customer profiles stay tied to the Stripe account where they were saved, and they do not move to a new Stripe account. More details in Stripe: Manage and Troubleshoot Account Connections.
- Protected Booking Website checkout: Custom scripts are disabled on the checkout page of your Booking Website, so that payments are processed in a PCI DSS-compliant environment. More details in Booking Website: Scripts and Widgets.