Security responsibilities

Each party is responsible for the security of the services and systems it controls. You are responsible for your website, devices, user access and handling of payment information. Etail is responsible for the safeguards and duties set out in its agreement. Providers retain their own responsibilities.

Each party must meet the security and validation requirements applicable to the systems it controls. Request current validation documents for the services and systems within your responsibility.

Give each authorized person only the access required for their role. Keep credentials and verification codes private, use available account protection features and remove access when a person no longer needs it.

Verify bank changes and unusual instructions through the designated secure process. Do not send passwords or complete bank details in a support email. Report suspected unauthorized access promptly.

Use the approved checkout and payment entry methods. PCI DSS requirements depend on the environment and the account’s validation obligations. A hosted checkout can reduce exposure but does not remove all merchant responsibilities.

Do not retain card verification codes, full magnetic stripe or equivalent chip track data, PINs or PIN blocks after authorization, even if encrypted. Keep payment credentials out of logs, analytics, support messages and ordinary email. Minimize other stored information and protect it under the applicable requirements.

• PCI Security Standards Council merchant resources

Maintain supported software, protect integration credentials, limit access and review changes that can affect checkout or customer information. Confirm payment and refund status before retrying an uncertain request. Preserve useful references without placing sensitive information in records.

Follow the integration and security instructions supplied for your account. Obtain current documentation from your integration contact before enabling a new function.

For systems and information each party controls, its documented safeguards must address the following in proportion to the information and risks involved:

• Individual access permissions, suitable authentication, periodic access review and prompt removal of unnecessary access.
• Secure transmission and storage, with encryption and control of keys where appropriate to the information and risk.
• Supported software, security updates, review of vulnerabilities and monitoring for unauthorized activity.
• Staff confidentiality duties, security awareness and restrictions on unnecessary copies or exports.
• Incident response, protected recovery arrangements where information is stored, and secure disposal at the end of retention.

Contact compliance@etaildepot.com with the affected service, approximate time and a brief description. Do not include passwords, complete card numbers, bank credentials or customer files in the first message. We will identify an appropriate channel for further information.

Take reasonable steps within your control to contain the issue and preserve relevant evidence. Follow the incident process and notice duties in the account and provider agreements. A routine report does not authorize access to another person’s systems or data.

Request current security and responsibility information for the services in your account, including the service scope, document version and issuing organization.

A security validation or assurance must identify the entity, service, systems, scope and period it covers. Using a certified provider does not certify all merchant or Etail systems. The accepted data terms state the safeguards required for the information each party handles.

• Data processing terms

Send legal notices and questions to compliance@etaildepot.com or Etail Depot US, Inc., 2001 L Street NW, Suite 500, Washington DC 20036, United States. Identify your business, service and the document concerned. Do not send identity documents, passwords or complete bank or card numbers by ordinary email.

• Contact compliance