Security and compliance
Our payment security approach: card data never enters VetBis
VetBis records payments and never processes cards. Amount, method and invoice link are kept; there is no field for a card number, CVV or expiry date anywhere in the system. There is no online card collection today. See payment records, the cash desk and the trust center for how the record side is protected.
Stays in VetBis
- Amount
- Method (8 types; online requires a provider)
- Date
- Invoice link
- Cash-desk entry
Never enters VetBis
- Card number
- CVV
- Expiry date
- Card PIN
What happens today
How a payment is recorded at the cash desk
Verification steps
Verifying subscription payment callbacks
This flow concerns VetBis subscription invoices, separately from clinic customer collections. Signature, freshness, amount/currency and event identity are checked. An unchanged replay creates no second payment; changed settlement details are rejected. The provider is not connected; the scene below uses sample data.
Run 2: unverifiable notification
- Did the notification come from the payment provider
- Is the notification current
- Do amount and currency match the invoice exactly
- Was this notification processed before
- Invoice closed, plan activated
RejectedThe flow stops; the invoice and plan stay unchanged.
Live flowRun 2: unverifiable notification rejected 6 / 6
Steps
- 1Run 1, step 1: source
- 2Run 1, step 2: freshness
- 3Run 1, step 3: amount
- 4Run 1, step 4: duplicate check
- 5Run 1 result: invoice closed
- 6Run 2: unverifiable notification rejected
No online collection today
A connection is planned; there is no live payment provider connection today.
PCI DSS
VetBis holds no PCI DSS certificate. Because card data does not pass through the system, we aim to keep the scope as narrow as possible; choosing a PCI DSS compliant provider is a requirement when we select one.
Controls that protect the payment record
Outside the card data boundary, the payment record is protected too: who can see it, who can change it and when it changed are answered in the record itself.
| Control | What it does | Where |
|---|---|---|
| Role and branch based permissions | Payment record and refund permissions are granted separately. | Security feature |
| Clinic and branch separation | Data is limited to the clinic and branch scope. | Data security |
| Audit log | Who changed what and when is kept in the record. | Trust center |
| Refunds and credit notes | A record is never deleted; a reversing entry is created. | Billing feature |
Frequently asked questions
No. A payment record holds amount, method, date and invoice link; there is no field for a card number, CVV or expiry date.
Not today. A payment provider connection is planned; once connected, card data stays with the provider and only a verified payment result reaches VetBis.
No, VetBis holds no PCI DSS certificate. Because card data does not pass through the system, we aim to keep the scope as narrow as possible; choosing a PCI DSS compliant provider is a requirement when we select one.
Not by online card. Write to us for plan and payment steps.