Trust & security
Built to be trusted
How XREDIT Pay keeps card data out of reach, keeps your store's data yours, and tells you when something's wrong.
Uptime, last 90 days
Days without a reported problem, from our status page. Right now: everything is working.
- Card payments90 of 90 days
- Registers & back office90 of 90 days
- Online ordering90 of 90 days
- Uber Eats & delivery orders90 of 90 days
- Texts & email90 of 90 days
- Website & applications90 of 90 days
Card data
Card numbers never touch XREDIT
Cards are read by the payment company's certified payment app on the terminal. XREDIT never sees, receives or stores card numbers.
Only the last 4 digits
A sale in XREDIT Pay can hold the last 4 digits of the card at most. Our database refuses anything more.
Payments by your processing bank
Card processing is provided by our processing partners and their member banks, under your merchant agreement with them.
Your store's data
Encrypted on the way
Every connection to XREDIT Pay uses HTTPS, enforced on every page, register and API.
Locked to your store
Each store's sales, menu, team and customers are walled off in the database itself: a login only ever reaches the stores it belongs to.
App connections encrypted
The keys that connect QuickBooks, Mailchimp, Uber Eats and other apps are encrypted (AES-GCM) before they're saved.
It's your data
No contract, and your data stays yours. Payroll and time punches download from the back office, and you can ask us for a copy of the rest anytime.
Who can do what
Roles
Owners, managers and crew each see only what their role allows. Pricing is set by XREDIT and shown read-only.
Staff PINs
Each person has their own 4-digit PIN. PINs are stored only in scrambled (hashed) form, never as the number itself.
Approved devices only
XREDIT can lock a store so only devices we've approved can sign in, and block a lost device so everyone on it is signed out right away.
XREDIT staff
Our admin tools need a password and a second sign-in step, and every action there is recorded with when and where it came from. The record can't be edited or deleted.
Texts and email
Only with permission
Promotions go only to customers who said yes. Replying STOP or unsubscribing takes them off for good, automatically.
Registered texting
Each store's texting number is registered with the mobile carriers.
Pricing programs
Card brand rules
Dual pricing, cash discount and surcharge programs are set up to follow card brand rules and state law. Surcharges never apply to debit or prepaid cards.
Clear at the register
With dual pricing, the register shows both the cash price and the card price on every item.
Watching for problems
Checked every 5 minutes
Our systems check themselves every 5 minutes for stuck payments, unanswered orders, failed texts and more, and alert our team right away.
Watched from outside too
An independent monitoring service checks the website and XREDIT Cloud around the clock, so we hear about an outage even if our own systems can't tell us.
Told when it matters
Anything that affects you is posted on the status page and shown on your registers and back office until it's fixed.
Who we work with
The companies that help run XREDIT Pay, and what each one does.
- SupabaseXREDIT Cloud's database and sign-in
- VercelHosts xreditpay.com and the back office
- ResendSends receipts and account emails
- TelnyxSends text messages
- Netevia, CardConnect and NexioCard processing, with their member banks
- Uber EatsDelivery orders, for stores that connect it
Policies and questions
Read our Privacy Policy, Terms of Use, Merchant Services Agreement and accessibility statement. Found a security issue, or have a question? Email support@xredit.com or call (702) 722-4330.