Schedule a demo

Pick a time with our team. The scheduler is provided by Calendly and sets its own cookies.

Prefer email? support@coriunder.com

We use your details to arrange your demo. Read our Privacy Policy.

Coriunder

Your merchants’ card data, inside our PCI scope.

Coriunder is built for European payment platforms that need full control over compliance, data residency and security. PCI DSS Level 1, GDPR-aligned, EU-only hosted - with the architecture to back it up.

Schedule a demo Compliance
PCI
DSS
PCI DSS Level 1
Audited annually by a QSA
Hosted page · SAQ-A
GDPR
GDPR-aligned
DPA signed by every client
Sub-processors disclosed
3DS2
3-D Secure 2 & SCA
TRA, low-value, MIT exemptions
Network tokens
EU
EU-only hosting
No transfers outside the EEA
No non-EU replicas
Inside our PCI scope
Card data captured, tokenised, stored
TLS 1.2+ in transitAES-256 at rest2FA for operatorsAudit trail on every action
CardaqCardaq
Banking CircleBanking Circle
The Bank of LondonThe Bank of London
CodegoCodego
CrassulaCrassula
Fintech LabFintech Lab

Trust & Security: where compliance meets architecture

Compliance, data protection and operational security - built into the platform, not bolted on.

Yes

PCI DSS Level 1

PCI DSS

EU-only data hosting

EU

GDPR-aligned end-to-end

What we hold

Built into every layer of the platform

Compliance and security live at the architecture layer - not as an afterthought. The same controls protect every Coriunder client, on the same EU-hosted infrastructure.

1Card data is captured in our scope
4242 •••• •••• 4242
→
tok_9fA3·k27Q
TokenisedStored in vaultNever on your servers
2Audited every yearQualified Security Assessor
PCI DSS Level 1
Annual QSA assessment · Report on Compliance
Pass
3Your scope depends on the integration
Hosted page or cashierSAQ-A
Server-to-server APISAQ-D

PCI DSS Level 1

Coriunder runs a fully PCI DSS Level 1 environment - annually audited by a Qualified Security Assessor. Card data is captured, tokenised and stored inside our scope. Clients using the hosted payment page or cashier typically qualify for SAQ-A; server-to-server integrations require SAQ-D.

See the certifications
1Processing runs in the EU
EU
Processing
EU
Storage
EU
Backups
2Nothing leaves the EEA
Replication to non-EU regionBlocked
Personal data transfer outside EEANone
3Fits regulated verticalsGDPR-bound
BankingiGamingForexPSPsData in EU

EU-only data hosting

All processing and storage stays inside the European Union. We do not replicate to non-EU regions and we do not transfer personal data outside the EEA - important for GDPR-bound platforms and regulated verticals.

Browse all methods
1Every client signs a DPA
Data Processing Addendum
Acme Payments · signed 03 Mar 2026
Signed
2Subject requests handled in the platform
Data subject requestsThis month
Access · DSR-0412Done
Erasure · DSR-0415In progress
3Sub-processors disclosed in writing
Data flows mapped
100%
Sub-processor list

GDPR-aligned end-to-end

Every Coriunder client signs a Data Processing Addendum (DPA). We map every personal-data flow, support data subject requests through the platform, and only use sub-processors disclosed in writing.

See subscription tools
1SCA exemption logic decidesBuilt in
TRALow risk
Low-valueUnder €30
MITMerchant-initiated
23-D Secure 2 only when needed
€84.00 · exemption TRAFrictionless
€1,249.00 · no exemptionChallenge
3Card stored as tokens
VISAVisa VTSNetworkActive
MCMC MDESNetworkActive
PSPPSP tokenDefaultActive

3DS2, SCA & tokenisation

3-D Secure 2 with full SCA exemption logic (TRA, low-value, MIT) is built in. We support PSP tokens out of the box and network tokens (Visa VTS / Mastercard MDES) on supported acquirers.

Create your first link
1Encrypted in transit and at rest
TLS 1.2+AES-256All data, all environments
2Roles with least privilege2FA enforced
RKRisk analystTransactions · read2FA
FNFinanceSettlements · write2FA
3Every action is logged
14:02 · finance@acme · fee template edited
14:05 · risk@acme · MID 40021 blocked

Operational security & access control

Encryption in transit (TLS 1.2+) and at rest (AES-256). Role-based access control with least-privilege defaults, audit trails on every action, and 2FA enforced for all platform operators.

Read the security overview
How it works

How we run security day-to-day

1

Monitor

Continuous monitoring of the platform with intrusion detection, log analysis and alerting on anomalous events.

2

Pen test

Annual penetration tests by independent third parties, plus continuous internal vulnerability scanning. Findings are tracked to closure with severity-based SLAs.

3

Go live

Documented incident-response process with on-call rotations, root-cause analysis on every incident, and customer notification within contractual SLAs.

Frequently asked questions

  • What is your PCI DSS scope?

    Coriunder operates a PCI DSS Level 1 environment, annually audited by a QSA. Card data is captured and stored inside our scope. Clients using the hosted payment page or cashier typically qualify for SAQ-A; server-to-server integrations require SAQ-D. The current Attestation of Compliance is available under NDA.

  • Where is data hosted?

    EU-only. All processing and storage stays inside the European Union. We do not replicate to non-EU regions and do not transfer personal data outside the EEA.

  • Do you have ISO 27001 or SOC 2?

    Not yet; both are on our roadmap. Our primary attestation is the PCI DSS Level 1 Attestation of Compliance, available under NDA. Talk to us about timelines if either is a procurement requirement.

  • Can I get a copy of your DPA?

    Yes. Every Coriunder client signs a Data Processing Addendum that maps personal-data flows, lists sub-processors and defines breach-notification timelines. We can share the standard DPA on request.

  • How do you handle sub-processors?

    We disclose every sub-processor in the DPA and notify clients before adding new ones. Each sub-processor is reviewed for security posture, GDPR alignment and data-residency before onboarding.

  • How do you manage incidents and disclose breaches?

    We follow a documented incident response process and notify affected clients without undue delay. Details are set out in our DPA.

Still have a question?

Need our DPA, security overview or sub-processor list?

Talk to our team - we share security documentation, sub-processor disclosures and DPAs under NDA.

Read our Privacy policy, Terms of service and Cookie policy. Privacy questions: josh@coriunder.com.

See the checkout Talk to our team

Security and compliance documentation is available under NDA. Talk to our team to request access.