Payment security
How your payment is protected
GetMyHotels never sees, stores, or transmits raw card numbers. Every payment is processed through a PCI DSS Level 1 certified provider — Stripe, Adyen, or Razorpay — using tokenized references and the latest authentication standards. Last reviewed 2026-05-27.
PCI DSSCard data security
We operate in the lowest PCI scope (SAQ-A) because card data is captured in hosted payment elements that load directly from our processors' PCI environment.
What we accept
Card networks
UnionPayDigital wallets
Apple Pay and Google Pay use device-bound tokens; the merchant (us) never sees the underlying card number even once.
Local methods
- • UPI (India, via Razorpay)
- • Net banking (India, via Razorpay)
- • iDEAL (Netherlands, via Adyen)
- • Bancontact (Belgium, via Adyen)
- • SEPA Direct Debit (EEA, via Adyen)
- • Klarna (select EEA + US markets, via Stripe)
Processors & their certifications
North America
- PCI DSS Level 1 Service Provider
- SOC 1 + SOC 2 Type II
- ISO 27001:2022
- EU-US Data Privacy Framework
EEA / UK / APAC
- PCI DSS Level 1 Service Provider
- Acquiring license (DNB regulated)
- ISO 27001:2022 + ISO 22301
- Intra-EEA processor for EU customers
India
- PCI DSS Level 1 Service Provider
- RBI-licensed Payment Aggregator
- ISO 27001:2022
- PA-DSS compliant tokenization
Fraud prevention
- Stripe Radar / Adyen RevenueProtect score every authorization against device fingerprints, BIN-country mismatches, and the card network's velocity rules.
- Bookings get a per-traveller velocity check (max 4 attempts / 24h on the same email or device fingerprint).
- Refunds, chargebacks, and disputes are reconciled to the underlying booking via a deterministic Idempotency-Key — no double-charge or double-refund paths.
- Sanctions screening (OFAC SDN) runs on every payer name before capture; payouts to listed entities are blocked.