> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rc.cleverhub.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Card Payment Security and 3DS2

> How Hello Clever protects card transactions through end-to-end encryption, tokenisation, 3DS2 authentication flow, and PCI DSS Level 1 certification.

Card payment security is central to Hello Clever’s approach to building merchant trust. This page covers the full security stack applied to card transactions on the Hello Clever platform: end-to-end encryption, card tokenisation, PCI DSS Level 1 certification, and 3D Secure 2 (3DS2) authentication, including when 3DS2 is triggered, what the authentication flow looks like, and how to handle the `3ds_url` returned in webhooks.

## Encryption: securing data in transit and at rest

Every card transaction on Hello Clever is protected by end-to-end encryption from the moment card data is entered through to confirmation and storage.

* **Encryption in transit**: card information is encrypted the instant it is entered, preventing interception during transmission.
* **Encryption at rest**: stored card data remains encrypted and shielded from unauthorised access, so a breach of storage does not expose raw card numbers.

## Card tokenisation

Hello Clever replaces sensitive card data with a randomly generated token that is meaningless outside Hello Clever’s secure environment. The original card details are never directly stored or transmitted after the initial capture.

<CardGroup cols={2}>
  <Card title="Secure repeat payments" icon="rotate">
    Tokenisation enables subscriptions and repeat billing without requiring customers to re-enter card details on every transaction.
  </Card>

  <Card title="Reduced breach risk" icon="shield">
    Because the token has no value outside Hello Clever’s system, a data breach cannot expose usable card information.
  </Card>
</CardGroup>

## PCI DSS compliance

Hello Clever is certified to **PCI DSS Level 1** (Payment Card Industry Data Security Standard), the highest level of certification available, covering encryption, access control, and data protection. Hello Clever conducts regular security reviews to maintain compliance as PCI requirements evolve.

<Note>
  Because Hello Clever handles card data on your behalf, using the JavaScript SDK or hosted checkout keeps raw card details off your servers and reduces your own PCI scope. Server-to-server integrations that submit raw card data require your environment to be PCI DSS-compliant.
</Note>

## 3D Secure 2 (3DS2)

3D Secure 2 is an authentication protocol developed by major card networks to verify the cardholder’s identity before an online transaction is processed. Hello Clever integrates 3DS2 into its payment gateway, applying it dynamically based on a real-time risk assessment of each transaction.

### How the 3DS2 flow works

<Steps>
  <Step title="Transaction analysis">
    When a customer initiates a card payment, 3DS2 assesses the risk level in real time. Factors evaluated include transaction amount, device fingerprint, geolocation, and purchase history.
  </Step>

  <Step title="Frictionless authentication">
    If the transaction is assessed as low-risk, authentication is completed silently in the background. The customer sees no additional step and the payment proceeds normally.
  </Step>

  <Step title="Challenge authentication (if required)">
    For higher-risk transactions, the customer is prompted to complete an additional verification step. This may include:

    * A one-time password (OTP) sent to their registered mobile number
    * Biometric authentication (fingerprint or facial recognition)

    This confirms the authorised cardholder is making the payment.
  </Step>

  <Step title="Completion and confirmation">
    Once authentication is complete, the transaction is processed and both the customer and your business receive immediate confirmation.
  </Step>
</Steps>

### Handling the 3ds\_url in webhooks

When a card transaction requires 3DS2 authentication, Hello Clever returns a `3ds_url` in the transaction webhook payload. You must redirect the customer’s browser to this URL to complete the authentication challenge.

```json theme={null}
{
  "event": "transaction.requires_action",
  "data": {
    "transaction_id": "txn_abc123",
    "status": "requires_action",
    "3ds_url": "https://3ds.helloclever.co/auth/txn_abc123"
  }
}
```

<Warning>
  If you do not redirect the customer to the `3ds_url`, the transaction will not complete. Ensure your webhook handler detects the `requires_action` status and initiates the redirect immediately.
</Warning>

After the customer completes authentication at the `3ds_url`, Hello Clever sends a follow-up webhook with the final transaction status (`succeeded` or `failed`).

### Benefits of 3DS2 for your business

<AccordionGroup>
  <Accordion title="Reduced fraud and chargebacks">
    Verifying the cardholder’s identity before processing the transaction significantly reduces fraudulent activity and the resulting chargebacks, protecting your revenue.
  </Accordion>

  <Accordion title="Higher conversion rates">
    The frictionless flow allows low-risk transactions to proceed without any customer involvement, reducing cart abandonment compared to older 3DS implementations.
  </Accordion>

  <Accordion title="Compliance with security standards">
    3DS2 aligns with PSD2 requirements in Europe and meets the latest payment security regulations, keeping your business compliant with regional mandates.
  </Accordion>

  <Accordion title="Improved customer confidence">
    Customers increasingly expect strong authentication for online payments. Knowing 3DS2 is in place reassures them that your business prioritises their security.
  </Accordion>
</AccordionGroup>

## How Hello Clever’s card security benefits your business

| Security layer                | Business benefit                                                 |
| ----------------------------- | ---------------------------------------------------------------- |
| End-to-end encryption         | Customer data is protected at every stage, reducing liability    |
| Tokenisation                  | Safe repeat payments without storing raw card data               |
| PCI DSS Level 1 certification | Meets the highest level of the card industry’s security standard |
| 3DS2 authentication           | Fewer chargebacks, higher conversions, regulatory compliance     |
| Active fraud monitoring       | Real-time detection and blocking of suspicious card activity     |


## Related topics

- [Create Payment via Card Information (S2S)](/api/cards/create-payment-via-card-information-s2s.md)
- [Real-time Payment Security at Hello Clever](/security/real-time-payments-security.md)
- [Card Payment API Overview](/api/card/overview.md)