menu

Payment API

What's on this page

General / Security & Privacy

Security and privacy

Masking

Due to PCI compliance requirements and GDPR regulations we are required to delete certain types of data as soon as possible or only keep it encrypted or masked.

When such data is later requested is it therefore returned in the same secured format. PAN and IBAN are masked in the same manner: if possible we will provide the first and last 4 characters, masking the rest.

Examples:

  • PAN 4111111111111111 becomes 4111XXXXXXXX1111
  • IBAN NL91ABNA0417164300 becomes NL91XXXXXXXXXX4300

When the value is too short, less than or equal to 8 characters, only the last 4 characters are returned. These values would likely be invalid but are safely masked nonetheless.