Built to protect every transaction.

PCI-DSS Level 1 is the highest tier of Payment Card Industry compliance, required of processors that handle more than 6 million card transactions per year. Practically, it means we undergo an annual on-site audit by a Qualified Security Assessor (QSA), maintain detailed access controls, encrypt all stored cardholder data, run quarterly external vulnerability scans, and remediate any findings on a strict timeline. For you, the practical benefit is that you don't have to worry about whether your processor meets the standard — and your own PCI compliance burden (as a Merchant) is reduced because the card data never reaches your systems.

If a breach occurs because of an issue in our systems — and you've followed the security obligations in your Merchant Services Agreement — you're not liable for the breach itself. Card network fines and forensic costs for processor-side breaches fall on us, not on you. Where liability does fall to merchants is when their own systems are the entry point (e.g., a compromised employee credential, an outdated POS device kept past its end-of-life date, or a skimmer attached to a terminal). That's why we cover Merchant obligations clearly in our Terms of Service.

Merchant data — including transaction records, account details, and customer information — is stored in Canadian data centres operated by our infrastructure partners and our processor. Backup copies are stored in geographically separate Canadian data centres for disaster recovery. Card data itself is held in our processor's PCI-DSS Level 1 environment, also located in Canada. We do not store any merchant or cardholder data outside Canadian jurisdiction.

Four ways. First, the principle of least privilege — no employee has access they don't actively need for their job. Second, mandatory background checks on all new hires and re-verification for anyone in privileged roles. Third, all production access is time-bound, logged, justified in writing, and approved by a separate manager. Fourth, full audit logs are reviewed weekly. We also conduct annual security training and run simulated phishing exercises quarterly.

The Clover system is designed so that even compromised employee credentials don't expose card data — because the card data isn't stored in your environment to begin with. The worst an internal actor could do is process unauthorized refunds or transactions, but every action is logged and traceable to a specific user. If you notify us of suspected fraud, we can pull a complete audit trail and reverse fraudulent transactions where eligible. We'll also help you respond and tighten your internal controls.

Yes, our SOC 2 Type II report is available to qualified prospects, customers, and partners under a mutual non-disclosure agreement. Email security@greatpos.com from your work address with the request. We typically turn around an NDA and provide the report within 3 business days. We can also share our PCI-DSS Attestation of Compliance (AoC) without an NDA.

For active security concerns — suspected device tampering, suspicious transactions, phishing attempts impersonating us — call us at (866) 667-1377 immediately, then follow up with details to security@greatpos.com. For ongoing operational status of our services, check our live System Status page which shows real-time service health and any open incidents.