Data Handling
You're being asked to hand us a processing statement. That's a real document with real numbers in it, so here's exactly what happens to it — in plain language, no certifications we don't hold.
What we never touch
We do not collect, store, transmit, or process cardholder data. No full card numbers, no track data, no CVV, no PIN blocks. AiPaymentsLab sits outside the cardholder data environment entirely — our tools read statements, residual reports, and gateway metadata, not card credentials.
Because we never handle cardholder data, we are not a PCI-DSS entity and we do not claim PCI compliance. If a tool ever needs to sit inside that scope, we'll say so plainly on that tool's page before you use it.
What we do collect
- Processing statements and reports you upload — PDF, CSV, XLS, or image, up to 3MB.
- Contact information you submit — name, work email, company, role, and whatever you write in the message field.
- Gateway and processor data, only for customers who connect an account: transaction, deposit, fee, chargeback, and residual records pulled via API with your credentials and your permission.
- Basic site analytics — we run no third-party analytics.
What happens to an uploaded statement
- It's transmitted over TLS and stored encrypted at rest on Replit/AWS.
- Our parser extracts the fields needed for the analysis — rates, fees, volume, interchange categories, downgrades.
- A deterministic rules engine does the math. AI reads. Rules decide. No model invents a rate, a fee, or a savings figure.
- You get the analysis back, typically within one business day.
- The source file is deleted within 30 days of the analysis being delivered. We keep the derived analysis so we can answer questions about it later; you can ask us to delete that too.
AI providers and your data
We use OpenAI and Anthropic to read and structure document text. Our accounts are configured so that your data is not retained by the provider and is not used to train their models. We do not sell, license, or share merchant data with processors, ISOs, lead brokers, or anyone else — not as a policy we might revisit, but as a thing we do not do.
Who can see your data
Access is limited to the people who need it to run your analysis or support your account. We're a small team; there's no offshore data-entry layer and no third-party review pool. Credentials for connected gateways are stored encrypted and used only for the operations you've authorized.
Subprocessors
| Provider | Purpose |
|---|---|
| Replit / AWS | Application hosting and encrypted storage |
| OpenAI / Anthropic | Document reading and text structuring |
| Gmail (Google Workspace) | Delivering analysis results and correspondence |
Ask us to delete it
Email brett@aipaymentslab.com and we'll delete your statements, analyses, and contact record. No form, no retention team, no thirty-day runaround. We'll confirm when it's done.
What we don't claim
We are not SOC 2 certified, not ISO 27001 certified, and not PCI-DSS validated. We'd rather tell you that than let a trust badge imply otherwise. If your organization requires a formal security review before sharing data, email us and we'll answer your questionnaire directly.