Yes - here's what that covers, and what it doesn't.
Mollie is certified as a PCI DSS Level 1 Service Provider, the highest compliance tier that exists. This status is independently re-validated every year by a Qualified Security Assessor (QSA), who audits our infrastructure, processes, and controls; and issues a Report on Compliance (RoC) and Attestation of Compliance (AoC).
In practice, this means the systems Mollie operates - the ones that route, process, and (where relevant) store payment data on your behalf - meet the strictest security bar the card schemes require of any organisation in the payments chain.
As a customer, does that mean I am PCI DSS compliant?
Mollie's certification covers Mollie's own infrastructure. It does not automatically make your business PCI compliant.
Good news: how much of PCI DSS actually applies to your business depends heavily on how you take payments through Mollie. Many customers - particularly those using Mollie Checkout or Mollie Components - carry very little of this burden themselves, because Mollie's infrastructure absorbs a lot of the risk.
Mollie's role in PCI DSS compliance
Getting PCI DSS compliant can feel overwhelming, especially if you don’t yet have a security framework in place to protect cardholder data. Mollie offers integrations which can help lessen your PCI DSS compliance scope significantly (for example Mollie Hosted Payment Page or Components).
But, although certain integrations may reduce your PCI DSS scope, it does not remove it entirely. If your website, app, or point-of-sale setup ever accepts card payments - you have your own PCI DSS obligations to meet, separate from ours. How much depends on your integration.
- Mollie’s responsibility: Mollie takes responsibility for protecting cardholder data from the moment it reaches Mollie through our payment interface. Once we receive your customers’ card data, it is stored and processed within a PCI DSS Level 1 Service Provider Cardholder Data Environment.
- Customer’s responsibility: You are responsible for keeping cardholder data secure and protected up until it reaches Mollie. Depending on how you integrate with Mollie, you may also need to meet PCI DSS requirements for storing card data.
To request a copy of our latest PCI DSS Attestation of Compliance (AoC), reach out to your Mollie contact or to our support team.
Read more