A Payment Gateway Built for How Your Business Actually Operates

PCI DSS, the Payment Card Industry Data Security Standard, is a set of security requirements developed by the PCI Security Standards Council and mandated by the major card schemes for any business that stores, processes, or transmits cardholder data. Merchants using a PCI DSS Level 1 compliant gateway benefit from the gateway provider's certification covering the transmission and processing environment, but PCI compliance obligations do not end there. Merchants remain responsible for their own systems, integrations, and data handling practices. The gateway's compliance reduces scope but does not eliminate the merchant's own obligations under the standard, which is why selecting gateway infrastructure with Level 1 certification matters from day one.

3D Secure is an authentication protocol operated by Visa (Visa Secure) and Mastercard (Identity Check) that adds a cardholder verification step during the transaction. When a transaction is authenticated through 3DS, liability for fraud-related chargebacks shifts from the merchant to the card issuer. This is referred to as liability shift. Liability shift applies when the issuer participates in the 3DS program and the authentication is completed successfully. Where an issuer does not support 3DS or declines to authenticate, liability rules revert to standard scheme terms. For merchants in verticals with elevated fraud exposure, including iGaming, subscriptions, and digital commerce, 3DS authentication is an important tool for managing chargeback ratios, though it does not apply to all transaction types and jurisdictions uniformly. 3DS2 is the current version and supports frictionless authentication flows for lower-risk transactions.

Payment routing is the logic that determines which acquiring connection a transaction is sent through. In a multi-acquirer setup, the gateway can route transactions based on factors including card type, issuing country, transaction value, acquirer performance, and fallback rules. Effective routing improves approval rates by directing transactions to the acquirer most likely to authorize them and avoiding acquirers with known performance issues for specific card types or geographies. For merchants with cross-border volume, smart routing logic is one of the most impactful levers for improving payment performance without changing the acquiring relationships themselves.

Fallback logic, also referred to as payment fallback architecture, is a set of rules that automatically reroutes a transaction to a secondary acquirer when the primary acquiring connection fails to return an authorization. A failed authorization can result from acquirer downtime, connection issues, or a decline that may succeed elsewhere. Well-configured fallback logic reduces revenue loss from technical failures and acquirer-specific declines without any manual intervention. The effectiveness of fallback depends on having more than one active acquiring relationship. This is why gateway configuration and acquiring redundancy are best addressed together rather than independently.

Recurring billing allows a merchant to charge a customer's stored card credentials on a scheduled basis without requiring the cardholder to re-enter payment details for each transaction. Visa and Mastercard update their recurring billing rules regularly, and compliance requirements have become more specific over successive rule cycles. Non-compliance with recurring billing requirements and subscription payment compliance obligations is one of the most common reasons subscription merchants receive elevated chargeback rates and scheme monitoring flags. Correct tokenization, transaction descriptor management, and cardholder communication are all part of maintaining compliant recurring billing infrastructure.

A PCI DSS Level 1 compliant gateway encrypts cardholder data in transit using TLS and handles tokenization, replacing the card number with a non-sensitive token, so that sensitive data is never stored in the merchant's own environment. This reduces the merchant's PCI scope because cardholder data never touches the merchant's own servers, limiting the systems and processes that fall within PCI assessment boundaries. The gateway also manages 3DS authentication flows and fraud screening tools that sit in the transaction path before authorization is requested. Merchants remain responsible for securing the environments around the gateway integration, including their own servers, APIs, and internal access controls.

These terms are often used interchangeably but refer to slightly different measurements. The authorization rate is the percentage of authorization requests that return a positive response from the issuing bank. The approval rate is sometimes used more broadly to include soft declines that are retried and subsequently approved. The gap between these two figures, transactions that are initially declined but later approved through retry logic, represents recoverable revenue that gateway configuration can capture. For subscription merchants, retry logic for failed recurring transactions is a significant payment performance and revenue recovery tool when managed within scheme rules.

A soft decline is a temporary decline that indicates the transaction may succeed if retried. Common reasons include insufficient funds at the time of the attempt, issuer authentication required, or a temporary processing issue. A hard decline indicates a permanent problem: the card is lost, stolen, cancelled, or the issuer has flagged the account. Soft declines should be retried following scheme-compliant retry logic within the parameters set by card scheme rules for merchants. Hard declines should not. Retrying hard declines against card scheme retry rules generates unnecessary scheme fees and can contribute to elevated fraud flags on the merchant's processing record.

The most important factors are acquiring connectivity, routing flexibility, compliance tooling, and support for the transaction types relevant to your business. A gateway that cannot support multi-acquirer routing offers no fallback protection. A gateway without compliant recurring billing infrastructure creates compliance risk for subscription merchants. For merchants in regulated verticals, the gateway's experience with 3DS configuration, fraud parameter tuning, and scheme threshold management is as important as the technical specification. For merchants with complex payment environments, the gateway is also the foundation of payment orchestration, the layer through which routing, fallback, and multi-PSP architecture are managed as a coordinated system. The gateway is the operational layer that sits between the merchant and every acquiring relationship. Its configuration quality directly affects payment performance and account stability. These are the capabilities StreamPayments evaluates when configuring gateway infrastructure for merchants, and the standard we apply across every integration we manage.