Merchant Line never stores card numbers. Every transaction is tokenized at the device, settled by Stripe, and audited end-to-end. This is how.
Merchant Line is a thin operational layer over a regulated payment processor. We're responsible for the catalog, the cart, the receipt, the reconciliation, and the scan. We are not in the path of card numbers.
Cards are entered on a Stripe-certified device — Tap to Pay on iPhone, Stripe Terminal, or the Stripe.js card element — and tokenized before they ever reach our servers. We see a payment intent, a status, and the last four digits. That's it.
Card present and card not present payments are processed by Stripe under their PCI DSS Level 1 service provider attestation. Merchant Line never sees, transmits, or persists primary account numbers (PAN), magnetic stripe data, or CVV.
What we do hold — operator profiles, catalogs, order metadata, ticket codes, scan logs, settlement reports — is encrypted in transit and at rest. Backups are encrypted with separate keys and stored cross-region.
The blast radius of a stolen credential is small by design. Operator staff can only do what their role permits, on the station they're signed into, during the event window they're scheduled for.
owner · manager · cashier · scanner · support — each with explicit grants for sell, refund, void, comp, and report-export.Built on managed AWS in two US regions, fronted by a global edge. Deploys are immutable, fully traced, and reversible in under 90 seconds. We aim for unglamorous infra — predictable, boring, well-understood.
us-east-1 primary · us-west-2 warm standbyThe hardest part of payments at a remote venue is what happens when the network goes down. Our offline behavior is deliberate, audited, and documented — not a happy accident.
When connectivity drops, registers continue to read tickets and queue card-present authorizations locally. Each queued auth is signed by the device, encrypted to the tenant's key, and stored in an append-only log. When the network returns, the queue is replayed in order. Conflicts are surfaced to the operator before settlement.
Card-not-present (typed-in) transactions are never permitted in offline mode.
On-call is a real human with a phone, not a status page. We notify affected operators within four hours of confirming a security incident, with a written postmortem within fifteen days.
status.getmerchantline.com.If you've found something, write us. We respond to every report within two business days and publish a credit (with your permission) on resolution.
PGP-encrypted reports preferred. We'll respond on your channel of choice within two business days.
Open an email →We share our SOC 2 readiness report, pen test summary, and DPA on request under NDA. Reach out from a corporate domain.