PCI DSS Compliant
Factory Labs is PCI DSS Compliant under SAQ-A. Card numbers are entered in CenPOS and Stripe hosted fields so Factory never stores PAN. Signed AOC and ASV Pass are published on the Trust Center.
Last reviewed · next review
No card data on Factory systems
Storefront capture uses a CenPOS Simple Web Pay iframe. Platform billing uses Stripe hosted fields. Factory receives tokens only; PAN and SAD never land in our databases or logs.
Level 1 TPSPs for capture
CenPOS and Stripe are PCI DSS Level 1 service providers. Factory Labs is not a PCI Level 1 service provider; card entry happens in their hosted fields.
SAQ-A with signed AOC + ASV
Architecture is SAQ-A eligible. An authorized officer signs the Attestation of Compliance. External ASV scan Pass is on file, with quarterly scans thereafter.
Merchant of record ready
Factory Labs can be merchant of record for storefront payments without storing cardholder data on our servers.
Evidence and detail
Checklist, roles, and review dates live on the Trust Center PCI tab. Request the gated evidence pack for signed AOC, ASV, and TPSP AoCs.