PCI DSS Level 1
The most stringent validation level under the Payment Card Industry Data Security Standard. All card processing runs on Level 1 certified infrastructure. The Attestation of Compliance is available on request.
Security and compliance
All payment processing runs on PCI DSS Level 1 certified infrastructure within eCourtDate’s secure environment, with SOC 2 Type II verified controls. Card numbers are tokenized and terminals use point-to-point encryption. Agency staff do not handle full card numbers, which reduces the agency’s PCI DSS scope.
PCI DSS Level 1SOC 2 Type IIEncryption in transit and at restTokenized card dataP2PE terminalsWCAG 2.1 AA
Certifications and verified controls
Documentation for each item is available for vendor risk reviews. The SOC 2 report requires a non-disclosure agreement.
SOC 2 Type II
Controls over security, availability, and confidentiality verified by an independent auditor over an observation period. Report available under NDA.
eCourtDate environment
GovPayPlan operates within eCourtDate’s secure environment, which also serves the company’s court reminder, communications, and case management products.
How the platform reduces agency PCI scope
Agency staff do not handle full card numbers. On every channel, card data goes directly to the processing environment and is not stored on agency systems. The applicable self-assessment questionnaire is identified during merchant registration.
- Online payments are entered on the hosted portal, not on agency web servers.
- Card numbers are tokenized at capture; agency records hold a token and the last four digits.
- Countertop and mobile terminals use point-to-point encryption. Card data is encrypted inside the device before transmission.
- Cashier users record cash, check, and money order payments without touching card data.
- Receipts and reports display masked account information only.
What an agency record containsExample
Payment methodVisa debit•••• 4417
Token referencetok_8f3…Stored
Full card numberNoneNot stored
Terminal encryptionP2PEEnabled
Access, identity, and activity records
Role-based access
Four roles: Administrator, Finance, Cashier, and Read-Only. Staff users are unlimited with no per-user fees. Each person gets an account with the access their job requires.
Multifactor authentication
Administrative access requires a second verification factor beyond a password.
Single sign-on
Enterprise plans connect staff sign-in to the agency identity provider while preserving GovPayPlan roles and permissions. Configured during onboarding.
Dual verification for payout accounts
Adding or changing the registered payout bank account requires verification by two authorized agency contacts.
Approval controls
Administrators can require a second authorized administrator to approve sensitive configuration changes before they take effect.
Activity history
Timestamped records of administrative actions and configuration changes are retained and available to authorized users for audit.
Transaction risk, fraud, and availability
Fraud screening
Payment networks flag or block suspected fraudulent transactions automatically. No action is required from agency staff. Agencies may also refund a charge they suspect is fraudulent.
Bot protection
Public payment pages are protected against automated abuse. Payers are not asked to complete extra steps.
Availability records
Uptime and incident history are provided with the security documentation package on request.
Chargebacks
Investigated and decided by the card issuer or bank. Chargeback activity is recorded in agency reporting.
Accessibility and language access
Public payment portals are built to WCAG 2.1 Level AA and support more than 100 languages. Interface text, instructions, and receipts display in the payer’s selected language.
- Keyboard operation for every step of a payment
- Visible focus, sufficient contrast, and meaningful form labels
- Layouts that adapt to phones, screen magnification, and assistive technology
- Receipts by email and text in the payer’s language
Documentation for your review
Request the PCI Attestation of Compliance, SOC 2 Type II report, accessibility conformance information, and architecture materials. Completed security questionnaires can be provided for vendor risk assessments.
Security and compliance questions
Yes. Portals are built to WCAG 2.1 Level AA and support more than 100 languages. Interface text, instructions, and receipts display in the payer’s selected language.
Payment networks automatically flag or block transactions they suspect are fraudulent; no action is required from your agency. Your agency may also proactively refund charges it suspects of fraud. Fraud determinations rest with the payment network.
Unlimited. Each subscription covers one agency account with unlimited staff users and no per-user fees. Access is role-based: Administrator, Finance, Cashier, and Read-Only. A separate court or issuing authority that requires its own portal, reconciliation, and payouts is covered by its own subscription.