Security and payment authority
How PaidonDue holds payment authority, what it stores, and how a customer withdraws their mandate.
PaidonDue
Software only. We never receive, hold or control your customer's money at any point. We act as your agent, sending payment instructions on your behalf, on rules you configure.
You, the merchant
You are the merchant of record. When a collection succeeds, funds settle directly to your account. You hold the merchant agreement that provides this; we only send payment instructions on the rules you configure.
How authorisation is captured
Before a collection attempt, your customer authorises it themselves on a hosted screen. That screen records:
- The exact authorisation text they agreed to, with its version
- Timestamp, IP address and device information
- The name they typed as their signature
- Payment method details and verification captured at setup, where applicable
A copy is emailed to them. These records help you respond to a dispute — it is never edited after the fact; a change to the arrangement creates a new record alongside the old one, which is kept.
Card and bank details
Card and bank details are entered on a secure hosted form and stored in a PCI DSS Level 1 certified vault; PaidonDue's servers never see or store full card or account numbers.
How a customer withdraws their authorisation
Every authorisation document names exactly two routes: contacting the merchant directly, or contacting their own bank. Cancellation requests are honoured promptly.
Data protection
PaidonDue stores limited references to each payment method, never full bank account numbers.