Compliance (integrator view)
Not legal advice. Counsel owns applicability to your organisation and merchants.
GDPR / UK GDPR
| Topic | Platform posture | Integrator duty |
|---|---|---|
| Roles | Often processor for shopper data; controller for merchant accounts | Honour your role in DPA; no secondary use of shopper PII |
| Access | Tenant isolation; admin audit | Scope keys tightly; no shared dumps |
| DSR | Export/delete tooling paths for merchants | Forward erasure/export requests; do not retain orphan copies |
| Transfers | EU-first hosting preference | Document sub-processors you introduce |
NIS2
IoneShop is engineered and operated toward NIS2-oriented requirements (risk management, monitoring, continuity, incident readiness).
This is not a “NIS2 certificate”, and using the API does not automatically make a merchant NIS2-compliant.
DORA
Relevant primarily for financial entities. Platform can support evidence packs and resilience discussions under Enterprise contracts — not a blanket DORA attestation via public docs.
ISO 27001
Docs may describe alignment of controls with common ISMS themes. Do not claim certified ISO 27001 unless a valid certificate is published by the company.
PCI DSS
- Cardholder data environment is the PSP
- IoneShop APIs accept payment tokens / session ids — never PAN/CVV
- SAQ / AoC questions for merchants: answer based on PSP redirect/token model + your own systems
Accurate claims only
Forbidden in partner marketing about IoneShop without evidence: fake SOC 2 / ISO / PCI “certified” badges. Prefer: “supports GDPR-oriented controls”, “designed toward NIS2”, “PSP handles card data”.
Enterprise assurance questionnaires are provided under NDA / Order Form — contact your Enterprise representative.