- PCI DSS Level 1
- Annual on-site assessment plus quarterly ASV scans; sub-merchants inherit the posture for card traffic alongside iDEAL.
- iDEAL via licensed connectivity
- iDEAL is delivered through a connected provider with the relevant Dutch bank-rail licensing; topropay routes and reconciles around it.
- PSD2 / SCA
- Selective 3DS2 on card authorisations; iDEAL inherits its own bank-side strong-customer-authentication by design.
- Signed webhooks
- Replay-safe webhook delivery with HMAC signatures; SIEM-friendly out of the box.
- Data residency
- Regional data-residency options for merchants under regulators that require it; EU-resident traffic stays in-region by default.
- Licensed verticals only
- Licensed gaming, regulated financial services and other compliance-bound verticals supported only where current operating licences exist. Grey and black-market verticals are out of scope regardless of integration shape.