How we protect your card and business data.

Card data never passes through EBS

When a customer pays at your counter, online, or on an invoice, the card goes straight from the terminal or the checkout page to our processing partner's platform, which carries its own PCI DSS validation and connects directly to the card networks. EBS servers never see, store, or log a full card number. Card entry on our own checkout page happens inside the processor's hosted form, so even that page cannot read the number.

• Terminals and POS systems we install take chip, tap, and mobile wallet payments, and the card number never appears in your POS software or ours.
• Saved cards for recurring billing live in the processor's PCI card vault. Your software holds a token, not a card number.
• Our installs are done by PCI QIR certified staff, the way the card brands require.

Your application

A merchant application asks for things we take seriously: each owner's Social Security number and date of birth, the business tax ID, and the bank account that receives deposits.

• Each of those fields is sealed on its own with AES-256-GCM encryption under a key that only exists in our hosting environment. A sealed value cannot be moved to another application or another field.
• They are never written to logs, never sent by email, and left out of our nightly backups.
• By default only the owner of EBS can open a field, one at a time, and every reveal is recorded with who, when, and which field, never the value.
• They are deleted 30 days after your account is live, or 90 days after the application if it never goes live.

The application page itself loads no advertising tags, no analytics, and no chat widget, and it runs under a strict content security policy that blocks any script we did not write.

Statements you send for a rate review

Statement pages are read by software to pull out the volume, the fees, and the card mix, and the pages and the numbers are kept in a private store that only EBS staff can open, so your account team can find the review later. They are not shared with a processor until you apply. If you do not move forward, we delete the upload within a reasonable period after the review, and sooner if you ask.

The Portal

• Every sign-in to the EBS Portal, for clients and for our team, happens over HTTPS with HSTS, so a browser will never load it unencrypted.
• Two-step sign-in with an authenticator app or a text code is available to everyone and required for the roles that can see money.
• Permissions are set by role. A staff member sees only the pages their role needs, and the owner can tighten any role from inside the Portal.
• Refunds are limited to the owner, tied to a charge on record, and locked after 30 days.

The website

• Served over HTTPS with HSTS preload, a frame-ancestors policy that stops other sites from embedding our pages, and a content security policy on the pages that take sensitive data.
• Forms are protected against bots and stored with our host, readable only by the EBS staff who need them.
• We do not ask for card numbers, Social Security numbers, or bank details through any ordinary web form. If a page ever does, it is the application, and it is handled as described above.

Card network rules and chargebacks

Dual pricing, surcharging, and debit handling are set up the way Visa, Mastercard, Discover, and American Express require: the signage, the receipt language, and the rule that debit and prepaid cards never carry a fee. When a chargeback lands, a person at EBS helps you pull the order details and respond, and we look at what caused it so fewer come in.

For what we collect and why, see the privacy policy. This page was last reviewed in November 2026.