Security
What we hold, where it lives, and which rules apply
A closed-loop platform sits in an unusual regulatory position: it moves money without touching card data and without being a bank. This page says plainly what that means for data protection, licensing and the scope of your own obligations.
Updated
Updated
Three things worth being precise about
Data protection. GDPR compliance is built into the platform rather than added at the edges: data minimisation, right of access, right to deletion, portability and consent management, with EU data centres by default and Data Processing Agreements available. Data is never sold, shared with third parties or used for advertising.
Licensing. Closed-loop programmes operate under PSD2's limited-network exemption and comparable frameworks elsewhere, which is why the usual cases need no EMI licence. Where a programme approaches the edge of that exemption — a merchant network broad enough to stop being limited — we say so during design rather than after launch.
PCI DSS. The closed-loop flow moves balance between accounts on our ledger and never handles a card number. That means it does not extend your PCI scope: card data remains your PSP's domain, and 7Konto sits beside it as a separate payment method.
- PSD3 is expected to tighten closed-loop rules while grandfathering compliant programmes; we track it and give partners notice well ahead of any structural change.
- All communication is encrypted in transit, and access to the admin panel is role-based and logged.
- Merchant and cardholder data belongs to you and the merchant — we operate it, we do not own it.
What we ask of a partner
- 01
Describe the network
Which merchants accept the value, so the limited-network position can be assessed honestly.
- 02
Agree the data flows
What is loaded from your systems, what we return, and what is retained.
- 03
Sign the DPA
A Data Processing Agreement covering the processing we do on your behalf.
- 04
Keep us told
If the merchant network broadens materially, the regulatory position needs revisiting before it is a problem.
Details
- Hosting
- EU by default; other regions on request
- Encryption
- In transit, throughout
- Access control
- Role-based, per tenant, logged
- Retention
- Per programme, configurable, minimised by default
- Data sale
- Never — no advertising or third-party sharing
- Sub-processors
- Disclosed in the Data Processing Agreement
Questions about this
Do I need an EMI or banking licence?
Not for the usual closed-loop cases: gift cards, employee benefit accounts, hotel guest accounts, event payments. They fall under the limited-network exemption in PSD2 and comparable frameworks elsewhere. Where a programme approaches the edge of that exemption — a very broad merchant network, for instance — we say so before it is built, not after.
Is 7Konto GDPR-compliant?
Yes, and it is built in rather than bolted on: data minimisation, right to deletion, right to access, portability and consent management. EU data centres by default, with Data Processing Agreements available.
Where is customer data stored?
EU data centres by default, which keeps GDPR straightforward and latency low for European merchants. Other regions are available where a customer needs them. Data is never sold, shared with third parties or used for advertising.
How does PSD2 apply, and what about PSD3?
Closed-loop programmes run under PSD2's limited-network exemption, and we help partners structure deployments to stay inside it. PSD3 is expected to tighten the rules while grandfathering existing compliant programmes; we track it and will give partners notice well ahead of any structural change.
What about PCI DSS on the online flow?
The online flow never touches card numbers — it moves balance between closed-loop accounts, which is a different regulatory regime from open-loop card processing. PCI DSS applies to card data, which stays your PSP's responsibility; 7Konto sits beside it as a separate payment method.
Ask us the compliance question before you build
A free 30-day pilot, configured and supported by our team.