EQC - Checkout - Stored Card Data and PCI Compliance

🔵 Overview This article explains what card information EQc actually retains when a customer checks out, why the full card number and CVV are never stored, and whether stored-card behavior can be turned off.

What Gets Stored At Checkout

The checkout screen where a card is entered is owned by ValPay/Adyen, so the user is not entering the card number directly into EQc, and at no point in the process does DemandBridge have access to the full card number.

  • Payment Token: A token produced by Adyen/ValPay that only functions with the one merchant account it was created for, so it has no value if obtained.
  • Last Four Digits & Expiration Date: Retained so a saved card can be identified on future orders. This is what appears on the checkout screen.
  • Full Card Number & CVV: Never stored anywhere in the system. PCI rules prevent saving the CVV, and even DemandBridge's engineering team cannot retrieve a card number once it has been entered.
💡 Note Even with a valid username and password, the full card number and security code are not accessible through the user interface - only the last four digits and expiration date are visible, to help a user identify their saved cards.

Can Stored Cards Be Turned Off?

⚠️ Critical Note There is no setting in EQc that disables card storage, either for an individual client's site or globally. The behavior is built into the platform and cannot be switched off.

If A Login Is Suspected Compromised

A compromised login would not expose a card number. However, it could let someone place an order against a card already saved to that account. If this is suspected, recommended next steps are:

  1. Have the affected user reset their password immediately.
  2. Review that user's order history to confirm there is nothing the cardholder didn't authorize.
  3. Have the cardholder notify their card issuer directly if they haven't already.
🟢 Best Practice Starting all users on a shared default password is worth rethinking, since an unchanged default is the most common way a storefront account gets accessed.

PCI Compliance

DemandBridge is fully compliant with the PCI Data Security Standard, which governs how card data is handled. DemandBridge completes an annual assessment against that standard with an independent qualified assessor. A current Attestation of Compliance is available for a client's team to review on request.

Frequently Asked Questions

Q: Can someone see a customer's full card number by logging into EQc, even with a valid username and password?

A: No. The full card number and security code are never accessible through the user interface. Only the last four digits and expiration date are visible.

Q: What does EQc actually store when a card is used at checkout?

A: A payment token valid only for that merchant account, plus the last four digits and expiration date of the card.

Q: Is there a way to disable stored cards in EQc?

A: No. There is no setting, per-site or global, that turns off card storage - it's built into the platform.

Q: If a customer's account login is compromised, can the card number be stolen through EQc?

A: No. A compromised login cannot expose the card number. At most, it could let someone place an order using a card already saved to that account, which is why reviewing order history and resetting the password are the recommended next steps.

Q: Where can I get proof of DemandBridge's PCI compliance?

A: DemandBridge completes an annual PCI Data Security Standard assessment with an independent qualified assessor and can provide a current Attestation of Compliance on request.

Tags: pci-compliance, stored-cards, eqc-checkout, payment-tokenization, security, password-reset, valpay, adyen

Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.