Card acceptance and PCI compliance: flexibility, control, and data ownership

Most teams approach card acceptance solely through the lens of compliance.

What they often don't realize is that these architectural decisions have consequences far beyond compliance: PSP lock-in, orchestration limitations, and no ownership of card data.

Whether you're a merchant accepting payments directly or a service provider supporting card flows for others, the same six architectures are on the table. They each offer varying levels of flexibility, control, and data ownership.

Join Shane Curran (Evervault CEO), Shane Peden (Aprio Partner, Risk Advisory and Assurance Services), and Masha Cilliers (Payment Industry Expert, iNED, Board Advisor) for a review of each architecture, the trade-offs that come with them, and how the picture shifts depending on whether you're attesting as a merchant or a service provider.

What you'll learn

• How architectural decisions shape PCI scope, vendor lock-in, and ownership of card data
• A framework for evaluating card collection methods by scope, control, flexibility, and data ownership
• Why multi-PSP routing depends on getting your architecture right from day one
• What changes when you're attesting as a merchant or a service provider

This session is designed for leadership, product, and engineering teams who are building or modernizing card acceptance.

Watch now for a clear framework to choose the architecture that fits your business, not just your compliance team.