Security you can actually check.
Plain descriptions of how card data moves, who holds what, and which obligations stay with you. Certification details are named in your proposal rather than implied here.
Where card data goes
Capture at the endpoint
Card data is captured by the payment terminal or hosted checkout page, not by your till software or your staff.
Encrypted transmission
Transactions are transmitted to the payment provider over encrypted channels from the terminal or checkout.
No card numbers in reporting
Nova Hub reporting shows truncated card details and scheme type, not full card numbers.
Authentication online
Online payments run through strong customer authentication within the checkout flow.
User access
Staff, manager and head-office permissions are separated, and refunds can be restricted to named users.
Device control
Terminals are provisioned to your account, and an endpoint can be identified, located in reporting and stood down when lost or replaced.
What stays with you
Your PCI obligations
Merchants have their own PCI DSS obligations depending on how they accept payments. We tell you which ones apply to the setup proposed for you and what evidence is required.
Your staff practices
Access control, refund permissions and physical terminal security are day-to-day merchant responsibilities. We configure the controls; you operate them.
Your own systems
Till, PMS and accounting systems that we integrate with remain under your control and your suppliers' support.
Data protection
Personal data you hold about your own customers remains yours. Our privacy notice covers the data we process and why.
Send us the security questions your finance team asks
We answer with what is documented and say plainly when something is not.