{"id":28163,"date":"2026-10-16T18:42:59","date_gmt":"2026-10-16T13:12:59","guid":{"rendered":"https:\/\/blog.razorpay.in\/blog\/?p=28163"},"modified":"2026-10-16T18:42:59","modified_gmt":"2026-10-16T13:12:59","slug":"payment-gateways-india-security-compliance-data-protection","status":"publish","type":"post","link":"https:\/\/razorpay.com\/blog\/payment-gateways-india-security-compliance-data-protection\/","title":{"rendered":"Payment Gateways in India: Security, Compliance and Data Protection"},"content":{"rendered":"<p>Payment gateway security is the set of controls that protects payment data and transactions, including card-data handling, encryption, authentication and fraud monitoring. For an Indian merchant, the right comparison also covers PCI DSS responsibilities, RBI requirements, customer-data protection and the help available when a payment needs investigation.<\/p>\n<p>This guide compares Razorpay with two anonymised alternatives, Payment Gateway A and Payment Gateway B. Start with the tables below, then use the detailed sections to check the controls, integration and support your business needs. Razorpay brings together documented checkout choices, TokenHQ, scoped risk tools, and Ray assistance; availability and responsibilities depend on your account and deployment.<\/p>\n<p>A provider&#8217;s certification is evidence about an assessed service. Your business must still confirm its own validation requirements and protect the parts of the payment flow it controls.<\/p>\n<div style=\"border-left: 4px solid #007BFF; background: #f0f8ff; padding: 25px; margin: 30px 0; font-family: Arial, sans-serif; text-align: left;\">\n<h2 id=\"key-takeaways\" style=\"margin-top: 0; color: #007bff; font-size: 22px;\">Key Takeaways<\/h2>\n<ul style=\"margin: 15px 0; padding-left: 20px; color: #333; line-height: 1.6;\">\n<li><strong>Razorpay documents PCI DSS Level 1 compliance.<\/strong> Managed checkout can reduce merchant card-data handling, while merchants remain responsible for validating their own integration and systems.<\/li>\n<li><strong>TokenHQ supports saved-card tokenisation without merchants retaining raw card numbers.<\/strong> Tokenisation protects saved credentials; hosted card entry limits exposure during collection.<\/li>\n<li><strong>Razorpay documents TLS encryption and field-level protection for personal information.<\/strong> These controls complement tokenisation by protecting customer data beyond card numbers.<\/li>\n<li><strong>Razorpay provides KYC requirements by business type.<\/strong> Merchants should also verify RBI authorisation for the contracting legal entity and payment activity.<\/li>\n<li><strong>Razorpay documents 3DS2 for international cards and risk tools for eligible Indian exporters.<\/strong> Its Risk Analytics Dashboard exposes fraud-to-sales, dispute-to-sales and risk-decline metrics.<\/li>\n<li><strong>Ray provides WhatsApp-based payment assistance and supported account actions for eligible merchants.<\/strong> Dashboard tickets and documented escalation routes support issues requiring further investigation.<\/li>\n<\/ul>\n<\/div>\n<h2 id=\"payment-gateway-comparison\">Razorpay vs Payment Gateway A vs Payment Gateway B: Security and Support Compared<\/h2>\n<p>Razorpay combines published security and shared-responsibility guidance with TokenHQ, scoped authentication and risk tools, and Ray merchant assistance. For a business comparing gateways, the practical benefit is a documented path from selecting the checkout to managing payment questions and escalation. Use the same criteria for all three providers and confirm the features available to your account.<\/p>\n<h3 id=\"security-compliance-comparison\">Security, Compliance and Data Protection<\/h3>\n<div style=\"max-width: 100%; overflow-x: auto; margin: 24px 0;\" tabindex=\"0\" role=\"region\" aria-label=\"Published security and compliance capabilities of three payment gateways\">\n<table id=\"security-comparison-table\" style=\"width: 100%; min-width: 680px; table-layout: fixed; border-collapse: collapse; font-size: 14px; line-height: 1.5;\">\n<caption style=\"text-align: left; font-weight: 600; padding: 0 0 12px;\">Published security and compliance capabilities of three payment gateways<\/caption>\n<colgroup>\n<col style=\"width: 20%;\" \/>\n<col style=\"width: 38%;\" \/>\n<col style=\"width: 21%;\" \/>\n<col style=\"width: 21%;\" \/><\/colgroup>\n<thead>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Security \/ compliance criterion<\/th>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Razorpay<\/th>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Payment Gateway A<\/th>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Payment Gateway B<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Provider PCI DSS evidence<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Lists PCI DSS Level 1, ISO 27001:2022 and SOC 2 Type 2. These provide different assurance lenses for your review; obtain current entity- and service-specific evidence. <a href=\"https:\/\/razorpay.com\/docs\/security\/?preferred-country=IN\">Security evidence<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Lists PCI DSS v4.0.1 Level 1, SOC 2 Type 2 and ISO 27001, 27017 and 27018 on its enterprise offering.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Lists PCI DSS Level 1, quarterly network scans and annual third-party audits; obtain the current service-specific attestation.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Merchant PCI responsibility<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">The shared-responsibility model spells out merchant duties. On-demand S2S requires continuing merchant PCI compliance and an AOC before each annual expiry, giving teams an explicit renewal requirement. <a href=\"https:\/\/razorpay.com\/docs\/security\/shared-responsibility-model\/\">Shared responsibilities<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Hosted web checkout collects payment details on the provider page. Merchant validation still depends on the implemented card-data path and applicable PCI scope.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Separates hosted checkout, mobile SDK and iframe collection from direct API card collection; merchants collecting raw card data retain PCI obligations.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Card-entry architecture<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Standard Checkout and hosted collection options let teams assess a managed card-entry journey. Trace where card data travels before choosing a custom or S2S integration. <a href=\"https:\/\/razorpay.com\/payment-gateway\/\">Payment Gateway<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Hosted web checkout uses a server-created order, browser checkout and payment-status confirmation; website-domain whitelisting is part of the documented integration.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Offers hosted checkout, mobile SDK and iframe flows that send card data to the provider, alongside a direct API option with different merchant scope.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Saved-card tokenisation<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">TokenHQ documents network-token and saved-card flows, helping teams plan repeat payments without retaining raw card numbers. Validate consent, token-requestor role, network coverage and account eligibility. <a href=\"https:\/\/razorpay.com\/card-tokenisation\/\">TokenHQ<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Documents a network-token vault, multi-gateway token interoperability and consent with two-factor authentication for token provisioning; supports checkout and API flows.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Documents card-on-file network tokenisation for Visa, Mastercard and RuPay, alongside saved-card checkout and device-tokenisation capabilities.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Encryption in transit and storage<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Security documentation describes HTTPS using TLS and encryption of sensitive user data. Review the controls against your actual service, stored fields and logs. <a href=\"https:\/\/razorpay.com\/docs\/security\/?preferred-country=IN\">Encryption controls<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Describes SSL\/TLS protection for customer data in transit. Obtain service-specific evidence for encryption at rest, key management and access controls.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Describes encrypted payment payloads, AES-256 protection for stored merchant\/customer records and authenticated APIs; verify scope and key-management evidence.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Customer data and privacy<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Documents field-level PII encryption alongside privacy terms. This supports a review covering customer information as well as card data; agree access, retention, deletion and logging responsibilities. <a href=\"https:\/\/razorpay.com\/docs\/security\/?preferred-country=IN\">PII controls<\/a>; <a href=\"https:\/\/razorpay.com\/privacy-policy\/\">privacy policy<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Lists ISO 27018 cloud-PII assurance on its enterprise offering. Review the privacy terms and agree retention, deletion and data-processing responsibilities.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Describes encryption of stored merchant\/customer records and internal access controls. Agree contractual retention, deletion and data-processing responsibilities.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">RBI entity and payment activity<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Verify the contracting entity and payment activity against official RBI records. Review domestic and cross-border service scope separately; a security certification is not an RBI authorisation. <a href=\"https:\/\/www.rbi.org.in\/Scripts\/BS_ViewMasDirections.aspx?id=12896\" rel=\"nofollow noopener\" target=\"_blank\">RBI PA directions<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Advertises domestic payment-aggregator and cross-border import\/export authorisations. Verify the contracting entity and licensed activity in official RBI records.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Offers a payment-aggregator service alongside its gateway. Verify the contracting entity and authorisation category rather than relying on consumer-app credentials.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Merchant KYC and onboarding<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Business-type KYC guidance gives merchants a document checklist before review. This helps teams prepare the right evidence; approval remains subject to business eligibility and required checks. <a href=\"https:\/\/razorpay.com\/docs\/payments\/business-types-kyc-documents\/?preferred-country=IN\">KYC documents<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Documents PAN-based business checks, consent-based CKYC, DigiLocker\/Aadhaar flows and bank-account verification, with requirements varying by entity and risk review.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Its WooCommerce onboarding requires account setup, document upload and completed KYC before activation. Obtain the entity-specific document checklist from onboarding.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">AML and continuing obligations<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Onboarding approval does not end due diligence. Record the PA and merchant roles for ongoing monitoring, suspicious-activity escalation and applicable reporting, using the RBI framework. <a href=\"https:\/\/www.rbi.org.in\/Scripts\/BS_ViewMasDirections.aspx?id=12896\" rel=\"nofollow noopener\" target=\"_blank\">Applicable PA duties<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Activation documentation describes beneficial-owner checks and enhanced due diligence; additional documents or video verification may follow the risk review.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Completed onboarding does not waive ongoing PA due-diligence and monitoring duties. Confirm merchant information requests and suspicious-activity escalation in the PG agreement.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Authentication and additional checks<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">3DS2 documentation specifies international-card scope and integration prerequisites, helping teams assess the intended authentication flow. Validate domestic authentication and account eligibility separately. <a href=\"https:\/\/razorpay.com\/docs\/payments\/payment-methods\/cards\/features\/3ds2.0\/?preferred-country=IN\">3DS2 scope<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Publishes international-card 3DS2 support and two-factor authentication for card-token provisioning; confirm the chosen integration and supported card flow.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Describes 3DS2 and risk-triggered additional authentication or declines for abnormal activity; confirm card, account and integration eligibility.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Fraud signals and screening<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Security documentation describes checks for hotlisted cards and unusual transaction patterns. Treat these as screening layers alongside authentication, fulfilment checks and your own fraud operations. <a href=\"https:\/\/razorpay.com\/docs\/security\/?preferred-country=IN\">Risk monitoring<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Describes ML screening across domestic and international payments, device fingerprinting and behavioural biometrics, with merchant-defined rules and blacklists.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Describes device, IP\/location, behavioural and transaction-velocity signals, plus automated declines or extra verification when activity appears abnormal.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Merchant risk visibility and controls<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Risk Analytics Dashboard exposes fraud-to-sales, dispute-to-sales and risk-decline metrics plus blocking rules for Indian exporters receiving international payments. This gives eligible teams named indicators to monitor. <a href=\"https:\/\/razorpay.com\/docs\/payments\/international-payments\/risk-visibility-dashboard\/\">Exporter risk dashboard<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Documents custom-rule impact analysis before activation and review of flagged transactions, including marking a payment safe or initiating a refund.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Describes velocity limits and risk-based transaction controls. Confirm which controls and reports your merchant account can inspect or configure.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Evidence of better security outcomes<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Use the documented risk indicators to support your evaluation, then compare confirmed fraud loss, false declines and incidents on the same transaction mix. No matched cross-provider outcome ranking was established.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Rule impact and flagged-payment controls are published capabilities; comparable fraud-loss and false-decline results require a matched assessment.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Risk signals and automated checks are published capabilities; comparable fraud-loss and false-decline results require a matched assessment.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>PCI DSS evidence and tokenisation appear across all three providers. Razorpay&#8217;s documented responsibility model helps you connect those controls to the integration your team will deploy. Its TokenHQ and product-specific authentication documentation also make the prerequisites explicit, so you can plan the right payment flow and evidence review.<\/p>\n<h3 id=\"merchant-support-comparison\">End-to-End Merchant Support and AI Assistance<\/h3>\n<div style=\"max-width: 100%; overflow-x: auto; margin: 24px 0;\" tabindex=\"0\" role=\"region\" aria-label=\"Merchant support from onboarding through payments, disputes and escalation\">\n<table id=\"support-comparison-table\" style=\"width: 100%; min-width: 680px; table-layout: fixed; border-collapse: collapse; font-size: 14px; line-height: 1.5;\">\n<caption style=\"text-align: left; font-weight: 600; padding: 0 0 12px;\">Merchant support from onboarding through payments, disputes and escalation<\/caption>\n<colgroup>\n<col style=\"width: 20%;\" \/>\n<col style=\"width: 38%;\" \/>\n<col style=\"width: 21%;\" \/>\n<col style=\"width: 21%;\" \/><\/colgroup>\n<thead>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Merchant support stage<\/th>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Razorpay<\/th>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Payment Gateway A<\/th>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Payment Gateway B<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Onboarding and activation<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Business-type KYC checklists and product\/technical support routes help merchants prepare documents and integration questions together. Compliance approval remains a separate decision. <a href=\"https:\/\/razorpay.com\/docs\/payments\/business-types-kyc-documents\/?preferred-country=IN\">Onboarding guidance<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Documents CKYC\/DigiLocker-based verification and activation support; enterprise merchants are offered dedicated technical and operational account managers.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Documents KYC before activation and integration-team UAT sign-off before production credentials are shared for the API integration.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Developer and integration help<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Integration guides, API references and Dashboard product\/technical tickets provide documented routes from implementation to investigation. Select the correct environment and include transaction references. <a href=\"https:\/\/razorpay.com\/docs\/payments\/dashboard\/support\/?preferred-country=IN\">Technical help<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Provides hosted-checkout guides, APIs\/SDKs and developer support; enterprise integration help includes migration and engineering assistance.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Dashboard includes Help &gt; Need integration support; developer documentation covers backend SDKs and Android, iOS, Flutter and React Native integrations.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Payment status and failures<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Ray provides account assistance through WhatsApp for payment questions and insights. Teams can use conversation for supported queries and tracked Dashboard tickets for unresolved investigations. <a href=\"https:\/\/razorpay.com\/ray-on-whatsapp\/\">Ray<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Dashboard AI answers account-specific payment queries and failure explanations; a separate WhatsApp assistant provides payment\/order lookups and support help.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Merchant Dashboard shows transaction information; order-status APIs and payment-success\/failure webhooks support automated status checks and investigation.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Refund assistance<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Ray launch material describes supported refund actions through WhatsApp account assistance. Verify account access and task authorisation; initiating a refund does not guarantee when the customer bank credits it. <a href=\"https:\/\/razorpay.com\/blog\/meet-ray-your-always-on-ai-account-manager-now-live-on-whatsapp\/\">Supported Ray actions<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Dashboard AI documents refund actions with user approval; available tasks depend on account permissions and product access.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Documents refund initiation and refund-status APIs, plus completed\/failed refund webhooks, so merchant systems can track the refund lifecycle.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Settlements and reconciliation<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Ray answers settlement questions and provides account insights through WhatsApp, giving eligible teams a conversational route to understand payment operations. Confirm supported tasks; an explanation is not a credit guarantee. <a href=\"https:\/\/razorpay.com\/ray-on-whatsapp\/\">Ray account assistance<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Dashboard AI describes settlement queries, reconciliation reports and approved instant-settlement actions; eligibility and charges remain product-specific.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Merchant Dashboard provides settlement and transaction reporting; use the selected reporting and support workflow to investigate unmatched amounts.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Disputes and evidence<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Documents dispute notifications, Dashboard accept\/contest actions and evidence submission against a respond-by date, giving teams an explicit case workflow. The issuing bank determines the outcome. <a href=\"https:\/\/razorpay.com\/docs\/payments\/disputes\/\">Disputes<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">A separate AI operations suite advertises dispute-response assistance alongside payment recovery and subscription dunning; confirm access and review requirements.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Obtain the PG-specific dispute notification, evidence-submission and deadline workflow during onboarding; consumer-app grievance terms are not sufficient evidence.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">AI channel and operational scope<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Ray is marketed as 24&#215;7 WhatsApp account assistance with English\/Hindi text and voice queries, payment insights and supported actions. This can suit teams managing payments from a familiar messaging channel. <a href=\"https:\/\/razorpay.com\/blog\/meet-ray-your-always-on-ai-account-manager-now-live-on-whatsapp\/\">Ray on WhatsApp<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Offers dashboard account AI, a separately enabled WhatsApp assistant and distinct operations agents for tasks such as recovery, disputes and dunning.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Advertises AI creation of payment pages from prompts. Evaluate payment-page creation separately from account investigation, refund assistance and human support.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Permissions and financial actions<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Ray describes a security-verification link for account actions. Review authorised access, approval steps and records for each financial task before enabling it for your operations team. <a href=\"https:\/\/razorpay.com\/blog\/meet-ray-your-always-on-ai-account-manager-now-live-on-whatsapp\/\">Ray verification flow<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Dashboard AI documents action approvals, existing Dashboard permissions and audit trails; WhatsApp access requires a separate enablement request.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">APIs use expiring client-credential access tokens; payment\/refund webhooks support authentication checks. API authentication is separate from internal approval of financial actions.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Contact channels and availability<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Dashboard tickets provide issue tracking. Chat\/callback is available to selected users; published chat hours are 10 a.m.-10 p.m. on working days. Ray availability and human support hours are separate. <a href=\"https:\/\/razorpay.com\/docs\/payments\/dashboard\/support\/?preferred-country=IN\">Support access<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Enterprise offering advertises 24&#215;7 priority support, dedicated account managers and custom SLAs; confirm the contracted tier rather than assuming universal entitlement.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Gateway marketing advertises 24\/7 support and a Dashboard integration-support route. Confirm staffed channels, response commitments and account coverage.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Unresolved issue and escalation<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">After a missed committed resolution TAT\/SLA, the available Dashboard escalation option provides priority handling and documented phone contact within two hours. That contact commitment is not a resolution deadline. <a href=\"https:\/\/razorpay.com\/docs\/payments\/dashboard\/support\/?preferred-country=IN\">Escalation process<\/a>.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Publishes a multilevel grievance process. Formal complaint timelines and enterprise contractual SLAs should be distinguished from routine ticket-resolution times.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Confirm the PG-specific escalation owner, channel and committed turnaround in the merchant agreement; do not substitute consumer-wallet or UPI complaint timelines.<\/td>\n<\/tr>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\" scope=\"row\">Support-quality evidence<\/th>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Compare first useful response, resolution, reopened tickets and authorised AI task completion using the same merchant tasks. Ray and the documented ticket\/escalation workflow are features to test, not measured proof of faster resolution.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">AI actions, enterprise account management and priority support are published features; no matched response or resolution ranking was established.<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">A 24\/7 availability claim and developer tools do not establish resolution speed; run the same support and task-completion assessment.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h3>When Is Razorpay a Strong Fit?<\/h3>\n<p>Razorpay brings together a documented merchant-responsibility model, TokenHQ saved-card flows, product-specific authentication guidance and tracked operational support. For Indian exporters receiving international payments, its Risk Analytics Dashboard names the fraud-to-sales, dispute-to-sales and risk-decline indicators a team can monitor. For eligible accounts, Ray adds English\/Hindi text and voice assistance on WhatsApp for payment questions and supported actions. These are concrete reasons to shortlist Razorpay when those workflows match your business. The alternatives also document substantial security and AI capabilities; suitability depends on the integration, account access and support terms you will actually use.<\/p>\n<h3>Which Core Metrics Should You Compare?<\/h3>\n<p>Ask every provider for the same transaction mix and observation period: confirmed fraud loss in basis points of processed value; false declines as a share of assessed legitimate attempts; comparable reportable incidents; median and p90 first useful response and resolution times; and reopened-ticket rate. Test AI answer accuracy and authorised-action completion on the same tasks. Published capabilities alone do not establish those results, and this review does not supply a matched performance ranking.<\/p>\n<h2>How Should You Compare Payment Gateways on Security and Compliance?<\/h2>\n<p>Compare payment gateways using current compliance evidence, the actual card-data path, supported tokenisation and authentication, merchant responsibilities, and operational help. Ask what each control covers, which account or integration can use it, and what remains your responsibility. A feature name alone is not enough to assess suitability.<\/p>\n<h3>Security, Compliance and Data Protection Answer Different Questions<\/h3>\n<p>Security is about protecting systems and transactions: access control, monitoring, encryption and fraud screening. Compliance is about the obligations that apply to your entity and activity, and the evidence that demonstrates them. Data protection is about collecting, using, sharing, retaining and deleting information appropriately. A control can be good security practice without being a statutory mandate, and a compliance document does not by itself prove a control works in your deployment.<\/p>\n<h3>Turn Feature Claims Into Evidence Requests<\/h3>\n<p>Three questions convert marketing copy into something you can file:<\/p>\n<ol>\n<li><strong>Can you show the service scope?<\/strong> Which legal entity was assessed, for which services, over which period.<\/li>\n<li><strong>Where do card details travel?<\/strong> In the exact integration you plan to deploy, not in a best-case architecture diagram.<\/li>\n<li><strong>What happens when the workflow fails?<\/strong> A failed payment, a refund that has not credited, a disputed transaction.<\/li>\n<\/ol>\n<p>Use a three-part framework for the file you retain: evidence reviewed, integration verified, responsibilities recorded.<\/p>\n<h2>How Can a PCI DSS-Compliant Gateway Reduce Merchant Compliance Burden?<\/h2>\n<p>Razorpay&#8217;s public security documentation lists PCI DSS Level 1. For a merchant, the potential reduction in card-data handling depends on the supported checkout flow and its implementation. Review the provider&#8217;s current service evidence, then confirm your own validation requirements. Provider compliance does not automatically certify your website or business.<\/p>\n<p>The <a href=\"https:\/\/razorpay.com\/docs\/security\/?preferred-country=IN\">Razorpay security documentation<\/a> describes the provider&#8217;s published status. The PCI Security Standards Council explains that <a href=\"https:\/\/www.pcisecuritystandards.org\/faqs\/does-pci-dss-apply-to-merchants-who-outsource-all-payment-processing-operations-and-never-store-process-or-transmit-cardholder-data\/\" rel=\"nofollow noopener\" target=\"_blank\">outsourcing payment processing does not remove every merchant obligation<\/a>. Request current evidence for the service and legal entity you will use.<\/p>\n<h3>Provider Evidence Is Not a Merchant Certificate<\/h3>\n<p>An Attestation of Compliance records that a named entity was assessed for named services over a defined period. Your validation is a separate exercise, usually a self-assessment questionnaire or a report agreed with your acquiring bank, covering your website, systems and processes. Level 1 is a validation classification, rather than a different version of PCI DSS. Confirm the applicable classification and validation route with the relevant acquirer or payment brand.<\/p>\n<h3>Match the Assessment to the Real Integration<\/h3>\n<p>Managed card entry can reduce the cardholder data your systems handle. The exact implementation still matters. The PCI Security Standards Council&#8217;s <a href=\"https:\/\/www.pcisecuritystandards.org\/faqs\/1588\/\" rel=\"nofollow noopener\" target=\"_blank\">SAQ A script-attack guidance<\/a> applies specifically to merchant webpages containing an embedded payment page or form. That particular eligibility criterion does not apply in the same way to redirect-only flows or fully outsourced payment links. Confirm all eligibility criteria for your deployment and review scripts that can affect payment security.<\/p>\n<p><strong>DID YOU KNOW #1:<\/strong> Outsourcing payment processing never removes every merchant obligation. The split is explained in our guide to <a href=\"https:\/\/razorpay.com\/blog\/pci-dss-compliant-payment-gateway-india\/\">Razorpay Checkout and merchant PCI DSS responsibilities<\/a>.<\/p>\n<h2>Tokenisation, Hosted Checkout and Hosted Fields: What Keeps Card Data Away From Your Servers?<\/h2>\n<p>Razorpay documents TokenHQ and managed checkout options for supported saved-card and payment flows. Tokenisation and card-entry isolation are separate design decisions. Before choosing an integration, trace where raw card details travel and confirm the exact supported option. Customising a checkout does not by itself prove that it uses isolated hosted fields.<\/p>\n<h3>Distinguish Card Entry From Saved-Card Tokenisation<\/h3>\n<p>Card entry is about the moment the customer types a card number: which party&#8217;s code renders that field, and which party&#8217;s systems receive the value. Tokenisation is about what happens afterwards, when an eligible saved credential is reused. The two can be configured independently. A token also does not mean your systems hold nothing sensitive: order records, customer names, addresses and payment references still flow to you.<\/p>\n<p>For saved cards, evaluate the supported token-requestor role and network flow rather than assuming that a tokenisation label describes every integration.<\/p>\n<h3>Compare the Integration Models Before Choosing<\/h3>\n<p><strong>Card-entry approaches and the questions merchants should resolve.<\/strong><\/p>\n<div style=\"max-width: 100%; overflow-x: auto; margin: 24px 0;\" tabindex=\"0\" role=\"region\" aria-label=\"Card-entry models and merchant responsibilities\">\n<table id=\"integration-model-table\" style=\"width: 100%; min-width: 680px; table-layout: fixed; border-collapse: collapse; font-size: 14px; line-height: 1.5;\">\n<caption style=\"text-align: left; font-weight: 600; padding: 0 0 12px;\">Card-entry models and merchant responsibilities<\/caption>\n<thead>\n<tr>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Approach<\/th>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">What to evaluate<\/th>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">Razorpay route to assess<\/th>\n<th style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere; background: #eef4ff;\" scope=\"col\">What must be confirmed<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Provider-hosted collection destination<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Whether a shared link or hosted page fits the customer journey<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\"><a href=\"https:\/\/razorpay.com\/payment-links\/\">Payment Links<\/a> or <a href=\"https:\/\/razorpay.com\/payment-pages\/\">Payment Pages<\/a><\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Supported payment flow, account access and merchant validation<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Managed checkout on a website or app<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Who controls card entry and where details travel<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Standard Checkout<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Exact embedding, scripts, plugins and supported data flow<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Isolated hosted fields<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Whether sensitive inputs are controlled by the provider in isolated components<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Request a documented integration-specific answer<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Obtain the exact SDK, supported architecture and eligibility in writing before selecting this option<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Custom checkout experience<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">The effect of custom inputs, scripts and API calls<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Custom Checkout documentation plus Product review<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">A custom interface is not synonymous with isolated fields<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Server-to-Server card integration<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Direct processing responsibilities and account prerequisites<\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\"><a href=\"https:\/\/razorpay.com\/docs\/payments\/payment-gateway\/s2s-integration\/\">On-demand S2S integration<\/a><\/td>\n<td style=\"border: 1px solid #cbd5e1; padding: 10px; text-align: left; vertical-align: top; overflow-wrap: anywhere;\">Continuing merchant PCI compliance and required AOC submissions<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>The S2S documentation is explicit that the merchant can capture payment details on its own server. That is the clearest case where your obligations increase rather than reduce.<\/p>\n<h3>TokenHQ Supports Specific Roles and Prerequisites<\/h3>\n<p><a href=\"https:\/\/razorpay.com\/card-tokenisation\/\">TokenHQ<\/a> covers the saved-card and network-token capability, including the distinction between Razorpay acting as token requestor and a business acting as its own token requestor. The <a href=\"https:\/\/razorpay.com\/docs\/payments\/payment-methods\/cards\/token-hq\/merchant-requestor-with-network-tokens\/\">business-as-requestor flow<\/a> is available on demand and for PCI-compliant merchants, so do not apply its prerequisites to every Standard Checkout saved-card feature. For the documented Razorpay-as-token-requestor flow, the <a href=\"https:\/\/razorpay.com\/docs\/payments\/payment-methods\/cards\/token-hq\/razorpay-requestor-with-network-tokens\/additional-information\/\">network activation notes<\/a> specify different go-live timings. Confirm the current timing for your networks and account. If token portability matters, ask which token-requestor flow, network rules and integration prerequisites apply.<\/p>\n<p><strong>DID YOU KNOW #2:<\/strong> A token protects a particular payment credential or flow. It does not replace appropriate handling of names, addresses, order records or support attachments.<\/p>\n<h2>How Do Encryption and Customer-Data Controls Complement Tokenisation?<\/h2>\n<p>Tokenisation replaces a payment credential with a substitute reference; encryption protects information in its applicable transmission or storage context. A merchant should also review access, logs, retention and support data. Evaluate these controls together, because reducing card storage does not remove the need to protect other customer information.<\/p>\n<h3>Keep Encryption Claims Specific<\/h3>\n<p>Razorpay&#8217;s <a href=\"https:\/\/razorpay.com\/docs\/security\/?preferred-country=IN\">security documentation<\/a> describes HTTPS using TLS and field-level encryption for personally identifiable information. These are specific controls you can assess alongside your own access and logging practices. Ask which services and data categories each control covers. A cipher or protocol name alone does not establish that one gateway produces better security outcomes.<\/p>\n<h3>Review Customer Information Beyond Card Numbers<\/h3>\n<p>Ask who inside your business can view full order information, what customer data enters application logs, what gets pasted into support tickets, and which retention terms apply. Razorpay&#8217;s <a href=\"https:\/\/razorpay.com\/privacy-policy\/\">published privacy policy<\/a> describes its handling terms, though a policy is a statement of practice rather than an independent audit. The Digital Personal Data Protection Rules, 2025 have phased commencement. Map the provisions applicable to your business and service to your notice, retention and data-handling processes. Check incident reporting and contractual notification duties separately.<\/p>\n<p>An illustrative scenario, not a recorded incident: a merchant removes all backend card collection, then a support agent attaches a screenshot of a full order record to a chat thread. The card data risk fell. The personal data risk did not. For technical depth, see our <a href=\"https:\/\/razorpay.com\/blog\/payment-gateway-tokenisation-encryption-india\/\">card and customer-data tokenisation and encryption checklist<\/a>.<\/p>\n<h2>What Should Indian Merchants Verify About RBI, KYC and AML Compliance?<\/h2>\n<p>Start with the legal entity and payment activity in your agreement, then check the applicable RBI authorisation and onboarding requirements. Review merchant KYC, settlement and grievance terms separately from technical security. A gateway&#8217;s authorisation does not transfer all of your business&#8217;s compliance duties.<\/p>\n<p>The governing instrument is the RBI Master Direction on Regulation of Payment Aggregators, dated 15 September 2025. A payment aggregator receives funds from customers and settles them to merchants, which is why it carries onboarding, escrow and due-diligence duties. A payment gateway in the narrow technical sense routes transaction data. Consumer payment apps, banks and verification APIs are different services again.<\/p>\n<h3>Match Entity, Activity and Contract<\/h3>\n<p>Request the contracting entity name, the relevant authorisation category, current evidence and the settlement terms. Then verify it against the RBI list of payment aggregator applications and authorisations rather than a vendor summary. Payment data storage obligations stem from RBI&#8217;s Storage of Payment System Data circular, which places responsibility on authorised payment system operators.<\/p>\n<h3>Merchant Onboarding Is Different From Your Customer KYC<\/h3>\n<p>Razorpay publishes <a href=\"https:\/\/razorpay.com\/docs\/payments\/business-types-kyc-documents\/?preferred-country=IN\">KYC requirements by business type<\/a>, showing that documentation depends on your constitution and activity. That is onboarding due diligence on you as a merchant. It is not proof that a provider offers a customer video-KYC or AML-screening API for your own users. The RBI PA directions also require ongoing monitoring against merchant business profiles and, for non-bank PAs, FIU-IND registration and applicable reporting. Ask how document re-review and unusual activity are handled. These provider duties do not replace any obligations that separately apply to your own business.<\/p>\n<p><strong>PRO-TIP #2:<\/strong> Ask what documents and consents are required, what can trigger a re-review, and where onboarding issues should be escalated. For the verification steps, use our guide to <a href=\"https:\/\/razorpay.com\/blog\/how-to-verify-an-rbi-authorised-payment-aggregator-in-india\/\">verifying an RBI-authorised payment aggregator<\/a>.<\/p>\n<h2>Which Authentication and Risk Controls Matter for Higher-Risk Transactions?<\/h2>\n<p>Assess authentication separately from fraud monitoring. Authentication helps verify the payer; monitoring helps assess transaction risk. Razorpay&#8217;s documented 3DS2 card feature is scoped to international cards, while its Risk Analytics Dashboard is described for Indian exporters. Confirm supported channels and account availability for the transactions you actually process.<\/p>\n<h3>Domestic and International Card Flows Need Separate Answers<\/h3>\n<p>The RBI&#8217;s September 2025 authentication announcement describes additional issuer risk checks beyond minimum two-factor authentication and retains SMS OTP as an available factor. It gives 1 April 2026 as the general compliance date, subject to directions with a different date. Confirm the applicable transaction scope, exemptions and issuer responsibilities rather than applying one flow to every payment.<\/p>\n<p>Keep that separate from 3DS2. Razorpay&#8217;s <a href=\"https:\/\/razorpay.com\/docs\/payments\/payment-methods\/cards\/features\/3ds2.0\/?preferred-country=IN\">3DS2 documentation<\/a> describes support for international card payments, with browser and app or SDK channels differing in availability. Do not convert that into a universal domestic-card capability, and do not import European SCA rules as India&#8217;s framework. Authentication success, payment success and fraud-loss outcomes measure three different things.<\/p>\n<h3>Compare Monitoring, Rules and Investigation Tools<\/h3>\n<p>Ask each provider which suspicious-transaction signals exist, which rules you can configure, who reviews flagged transactions, and what dispute evidence the system retains. Razorpay&#8217;s <a href=\"https:\/\/razorpay.com\/docs\/payments\/international-payments\/risk-visibility-dashboard\/\">Risk Analytics Dashboard<\/a> is documented for Indian exporters receiving international payments, so do not assume it is enabled for every domestic account. An issuer-side authentication service is not evidence that you control that engine, and payment routing is a reliability feature, not an AML guarantee.<\/p>\n<p><strong>DID YOU KNOW #3:<\/strong> A successful authentication is not proof that a transaction is risk-free. Our <a href=\"https:\/\/razorpay.com\/blog\/strong-customer-authentication-payments-india\/\">domestic and international authentication guide<\/a> sets out the scope differences.<\/p>\n<h2>How Does Merchant Support Work From Onboarding to Escalation?<\/h2>\n<p>Evaluate support across the merchant lifecycle: onboarding, integration, payment investigation, refunds, settlements, disputes and unresolved issues. Razorpay documents technical help, Dashboard tickets and escalation, while Ray offers announced WhatsApp assistance for account queries and supported actions. Check availability, permissions and human contact separately from resolution quality.<\/p>\n<h3>Start With Onboarding and Integration Help<\/h3>\n<p>Start onboarding by preparing the right documents. The <a href=\"https:\/\/razorpay.com\/docs\/payments\/business-types-kyc-documents\/?preferred-country=IN\">business-type KYC documentation<\/a> tells you what to assemble before you apply. Technical and product queries route through the <a href=\"https:\/\/razorpay.com\/docs\/payments\/dashboard\/support\/?preferred-country=IN\">documented support process<\/a>. Keep two things apart: a developer troubleshooting a webhook signature is a support topic, while a compliance team&#8217;s approval of your business category is a review decision with its own timeline.<\/p>\n<h3>Follow the Payment Through Refunds and Settlements<\/h3>\n<p><a href=\"https:\/\/razorpay.com\/ray-on-whatsapp\/\">Ray<\/a> is presented as WhatsApp-based account assistance covering payment and settlement questions, insights, payment-link creation and supported refund actions, per <a href=\"https:\/\/razorpay.com\/newsroom\/razorpay-launches-a-conversational-ai-account-manager-ray-on-whatsapp-for-businesses-in-partnership-with-indusind-bank\/\">Razorpay&#8217;s launch announcement<\/a>. The <a href=\"https:\/\/razorpay.com\/blog\/meet-ray-your-always-on-ai-account-manager-now-live-on-whatsapp\/\">Ray WhatsApp overview<\/a> describes a security-verification link for authenticated account actions. Confirm rollout, access, permissions and available actions for your account. A status answer, a refund instruction and a final bank credit are separate events.<\/p>\n<p>An illustrative scenario: a customer asks why a refund has not arrived. You retrieve the payment reference, confirm the refund was initiated and when, and tell the customer what has happened on your side. If the expected credit window has passed, you raise a Dashboard ticket with the payment ID and refund ID attached.<\/p>\n<h3>Keep Dispute Evidence and Escalation Visible<\/h3>\n<p>The <a href=\"https:\/\/razorpay.com\/docs\/payments\/disputes\/?preferred-country=IN\">disputes documentation<\/a> describes notifications, Dashboard review and evidence submission, including proof of delivery and invoices, with a respond-by deadline. The issuer decides the outcome of a contested dispute. That is a workflow benefit, not a guaranteed chargeback win.<\/p>\n<p>Razorpay&#8217;s <a href=\"https:\/\/razorpay.com\/docs\/payments\/dashboard\/support\/?preferred-country=IN\">published support process<\/a> states that an escalation option becomes available on a ticket when its committed resolution TAT or SLA is not met, after which the case moves to a priority queue and a representative contacts you by phone within the next two hours. That is conditional contact, not a two-hour resolution promise. Live chat and callback are documented for selected users, with chat hours of 10 a.m. to 10 p.m. on working days.<\/p>\n<h3>Compare AI Access and Controls Fairly<\/h3>\n<p>Payment Gateway A documents dashboard AI account assistance, a WhatsApp merchant assistant and separate AI operations agents. Payment Gateway B publishes 24\/7 support and AI payment-page creation. Evaluate the tasks, permissions and escalation route each option makes available to your account. Ray gives eligible Razorpay merchants a conversational workflow to assess alongside the Dashboard support process. The standards body&#8217;s guidance on <a href=\"https:\/\/blog.pcisecuritystandards.org\/ai-principles-securing-the-use-of-ai-in-payment-environments\" rel=\"nofollow noopener\" target=\"_blank\">securing AI in payment environments<\/a> notes that where an AI has agency to perform actions, incident response planning must account for it.<\/p>\n<p><strong>PRO-TIP #3:<\/strong> Request the same demonstration from each provider: one account-specific payment query, one permitted refund action and one unresolved issue. Keep raw card details and API secrets out of chat.<\/p>\n<h2>What Should You Check Before Launching or Changing Your Checkout?<\/h2>\n<p>Work through these seven steps and keep the output of each on file.<\/p>\n<ol>\n<li>Record the legal entity, the payment activity and the selected integration.<\/li>\n<li>Obtain current service-specific compliance evidence and record its scope and period.<\/li>\n<li>Map the card-entry, order and payment-confirmation paths for your actual build.<\/li>\n<li>Confirm your merchant validation requirement and which controls each party owns.<\/li>\n<li>Test the permitted tokenisation, authentication and payment-status flows in the appropriate environment.<\/li>\n<li>Check authorised access, logs, support attachments and the escalation route.<\/li>\n<li>Approve launch through your own review process, and repeat after any material change.<\/li>\n<\/ol>\n<p>Completing the checklist does not certify your business. It produces the records your reviewers, acquirer and auditors will ask for.<\/p>\n<h2>Frequently Asked Questions<\/h2>\n<h3>Does using Razorpay automatically make my business PCI DSS compliant?<\/h3>\n<p>No. A provider&#8217;s attestation covers its assessed entity and services. Your business still completes its own validation, usually a self-assessment questionnaire agreed with your acquirer, covering your website, scripts and processes. See our guide to <a href=\"https:\/\/razorpay.com\/blog\/pci-dss-compliant-payment-gateway-india\/\">Razorpay Checkout and merchant PCI DSS responsibilities<\/a>.<\/p>\n<h3>Are hosted fields, Standard Checkout and tokenisation the same thing?<\/h3>\n<p>No. Hosted fields isolate sensitive inputs inside provider-controlled components. Standard Checkout is a managed checkout experience. Tokenisation replaces a stored card credential with a reference for eligible later payments. Verify the exact integration you deploy.<\/p>\n<h3>What is the difference between tokenisation and encryption in payment security?<\/h3>\n<p>Tokenisation replaces a payment credential with a substitute reference for an eligible payment flow. Encryption protects information using keys and can protect card data as well as names, addresses and order records. Card tokenisation does not automatically protect those other records, so apply appropriate encryption, access, retention and logging controls.<\/p>\n<h3>What KYC and RBI evidence should I review before choosing a gateway?<\/h3>\n<p>Match the contracting legal entity and the payment activity against RBI&#8217;s published authorisation records, then review merchant KYC documents by business type, settlement terms and grievance routes. Start with our guide to <a href=\"https:\/\/razorpay.com\/blog\/how-to-verify-an-rbi-authorised-payment-aggregator-in-india\/\">verifying an RBI-authorised payment aggregator<\/a>.<\/p>\n<h3>Does Razorpay support 3DS2 for domestic and international cards?<\/h3>\n<p>Razorpay&#8217;s current <a href=\"https:\/\/razorpay.com\/docs\/payments\/payment-methods\/cards\/features\/3ds2.0\/?preferred-country=IN\">3DS2 documentation<\/a> describes support for international card payments, with browser and app channel differences. Confirm your domestic card authentication flow separately, since India&#8217;s requirements are set by RBI&#8217;s authentication directions.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Payment gateway security is the set of controls that protects payment data and transactions, including card-data handling, encryption, authentication and fraud monitoring. For an Indian merchant, the right comparison also covers PCI DSS responsibilities, RBI requirements, customer-data protection and the help available when a payment needs investigation. This guide compares Razorpay with two anonymised alternatives,<\/p>\n","protected":false},"author":180,"featured_media":28171,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[906],"tags":[],"class_list":{"0":"post-28163","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-payment-gateway"},"_links":{"self":[{"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/posts\/28163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/users\/180"}],"replies":[{"embeddable":true,"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/comments?post=28163"}],"version-history":[{"count":7,"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/posts\/28163\/revisions"}],"predecessor-version":[{"id":28170,"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/posts\/28163\/revisions\/28170"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/media\/28171"}],"wp:attachment":[{"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/media?parent=28163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/categories?post=28163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/razorpay.com\/blog\/wp-json\/wp\/v2\/tags?post=28163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}