Is Omno PCI DSS compliant?
Yes. Omno handles cardholder data in line with the Payment Card Industry Data Security Standard and is responsible for the security of the cardholder data it stores, processes or transmits on behalf of merchants. The exact compliance level and the date of the current attestation of compliance are shown in the facts on this page, so they always match the latest assessment.
Omno’s formal commitments on cardholder data, including its responsibility for customer data security, regular audits, staff training and incident response, are published in the website security commitments.
How does Omno handle payment data?
Omno is designed so that merchants handle as little sensitive data as possible. When a customer pays by card in the hosted checkout, the card number is captured in Omno’s environment and never passes through the merchant’s servers. If the customer saves the card, Omno stores it and returns a token, a reference that has no value outside Omno. The merchant keeps the token, the card brand and the last digits, which is enough to show the customer which card they used.
Personal data is processed to provide payment services and to meet legal obligations, as described in the privacy policy. Safeguards include restricted access to data, encryption, firewalls and protection against malware. Payment service providers connected to the platform receive the data they need to process each transaction.
How is access to the platform controlled?
The Omno dashboard uses role-based access control. Each user gets a role that defines what they can see and change: routing rules, risk settings, reports, exports or card blocking. With multi-brand management, access can also be limited to specific brands or legal entities, so a support agent for one brand does not see another brand’s data.
Merchants should give each person their own account, grant the smallest role that fits the job and remove access promptly when someone leaves. Every routing decision is logged, so payment outcomes can be traced.
How do card blocking and risk controls protect merchants?
Card blocking lets a merchant stop a card linked to fraud or a chargeback from being used again, before the payment reaches a provider. Customer verification levels and customer groups restrict which providers a customer can use, so unverified customers only reach providers that accept them. Every transaction is scored for risk before it is processed, and blacklists and blocked cards are shared across partner merchants, so a card stopped for fraud at one shop is refused at the others. Together these controls reduce fraud losses and help merchants stay within acquirer and card scheme monitoring limits.
How should merchants secure webhooks?
Webhooks are the source of truth for final payment outcomes, so they deserve the same care as any other financial instruction. Merchants should:
- Verify each webhook as described in the webhooks guide before acting on it.
- Accept webhooks only over HTTPS on an endpoint that is not guessable.
- Treat webhooks as idempotent, so a repeated delivery does not credit a balance twice.
- Confirm high-value outcomes with Get Transaction Info before releasing funds or goods.
- Never trust a browser redirect or client-side event as proof of payment.
What happens if there is a security incident?
Omno maintains an incident response plan to contain and resolve security incidents quickly and limit their impact. If an incident affects merchants or their customers, Omno notifies those affected in line with applicable regulations and its agreements.
How do I report a vulnerability?
Send details to security@omno.com. Include what you found, where, how to reproduce it and what impact you expect. Please act in good faith: do not access or change data that is not yours, do not degrade the service for others, and give Omno reasonable time to fix the issue before disclosing it. Omno reviews every report it receives and will contact you if it needs more detail.