Processor hosted card capture
Processor hosted fields embedded in your page, or a processor managed checkout page. The card data goes directly from the browser to the processor, and your server receives a token.
Solution
Payment Integration
We integrate your software with processors such as Stripe, Square and Adyen using hosted fields, tokenization and processor managed checkout, which keeps card data out of your systems and reduces your PCI scope.
Overview
What the system does
Sawhorse is not a payment processor. We do not hold a PCI certification and we do not build card processing infrastructure. What we build is the integration between your software and the processor you have chosen.
That distinction decides the architecture. Card details are captured by fields the processor serves and controls, exchanged for a token, and your systems only ever handle that token. Sensitive authentication data never reaches your servers, your logs or your database.
The rest of the work is the money state machine: authorisation, capture, refunds, disputes, reconciliation, and the webhook handling that keeps your records and the processor in agreement.
Who needs this
Merchants and platform operators connecting their application to Stripe, Square, Adyen or another selected payment provider.
What we build
Build payment gateway adapters, merchant onboarding handoffs, refund/dispute operations and settlement reporting. Processor vaulting returns references; it does not require storing card data in the client application. ACH and recurring payments need method-specific authorization and asynchronous states.
Modules
Core modules
Tokenization
A token replaces a card number in an integration. Processor references and network payment tokens have different restrictions. Protect tokens and the credentials that can use them; tokenization reduces card-data exposure but does not make a payment credential harmless.
EMV and card present
Where payment happens in person, EMV chip transactions run on certified terminals supplied by the processor. The terminal performs the cryptographic authentication with the chip, and the integration receives the result rather than the card data.
3D Secure and strong customer authentication
EMV 3D Secure supports issuer authentication for online card payments. It can help satisfy applicable strong customer authentication requirements, subject to scope, exemptions and processor guidance. The result may be frictionless or require a challenge. Liability treatment depends on the transaction and card-network rules.
Payment lifecycle
Authorisation, capture, partial capture, void, full and partial refund, each as an explicit state with the event that causes it.
Webhook handling
Signature verified, timestamp checked, deduplicated by event identifier and processed idempotently, because the processor, not the browser redirect, is the reliable signal that money moved.
Disputes and chargebacks
Dispute events surfaced with deadlines, evidence assembled from your order and delivery records, and the outcome written back against the transaction.
Idempotency, timeouts and retries
Give each payment operation a stable idempotency key supported by the processor. After a timeout, retrieve the operation state before attempting a new charge. Retry eligible transient failures with bounded backoff, keep pending payments distinct from declines, and surface exhausted retries for review.
Reconciliation
Processor payouts matched to transactions and fees, so the amount arriving in the bank can be explained line by line.
PCI scope management
Appropriate hosted interfaces can keep card details outside the application and reduce PCI DSS scope. Merchant responsibilities remain, including the applicable validation and security obligations. The acquirer and qualified assessor determine the requirements for the actual implementation.
Architecture
How it fits together
A typical implementation flow, with explicit responsibilities at each boundary.
Integrations
- Stripe for online and in person payments
- Square for point of sale and online
- Adyen for multi region and multi method acceptance
- Accounting systems for settlement posting
- Order, booking and subscription systems
- Tax calculation services
- 01
Collect
Use hosted checkout, hosted fields or processor-supported EMV/NFC terminals.
- 02
Record
Verify webhooks and apply authorized, pending, captured, refunded or disputed states idempotently.
- 03
Reconcile
Match transaction, fee, transfer and payout references; queue unresolved differences for review.
Security and controls
Design for the exceptions, not just the happy path.
Hosted interfaces can reduce PCI scope, not remove every responsibility. Merchant KYC/KYB and regulated processing remain with the provider. Fraud signals or risk scores should feed controlled review rules. Sawhorse does not act as a processor or claim PCI certification.
Technology options
We select the final stack after reviewing your existing systems and operating requirements.
Security and IP practicesFit
Industries that use this
FAQ
Questions people actually ask
What is PCI DSS and does it apply to us?
The Payment Card Industry Data Security Standard is the set of requirements that applies to any organisation that stores, processes or transmits cardholder data. It applies to merchants accepting cards. How much of it applies depends on how you accept payment, which is exactly what the integration design controls.
How does using hosted fields reduce our PCI scope?
Because the card details never enter your systems. The fields are served by the processor from its own domain, the browser sends the card straight to it, and your servers only ever see a token. That removes your systems from the flow of cardholder data. Your acquirer and assessor confirm the validation route that applies to you.
What is tokenization?
Tokenization substitutes a reference for a card number. Restrictions depend on the token type and provider. Tokens and API credentials still need protection, particularly when they can authorize future payment operations.
What is 3D Secure and when is it required?
EMV 3D Secure supports issuer authentication for online payments. It can help meet applicable strong customer authentication requirements. Whether authentication is required and whether liability shifts depends on the transaction, exemptions, processor and network rules.
What is EMV and does it matter online?
EMV chip specifications support card-present transactions. EMVCo also defines technologies used online, including EMV 3D Secure and payment tokenization. These address different parts of payment security and are not interchangeable.
Can you build our own card processing?
No. We integrate with processors. We are not a payment processor, we hold no PCI certification, and we do not build card processing infrastructure.
How do you handle chargebacks?
Dispute events arrive by webhook with deadlines. The system assembles evidence from your order, delivery and communication records, submits it through the processor, and records the outcome against the transaction.
Why create the order from a webhook rather than the redirect?
Because a customer can close the browser after paying. The webhook is the reliable signal. It is verified, deduplicated and processed idempotently, and the success page simply reads the resulting order.
Let’s talk about the system you need.
Tell us where the current process breaks down. We can map the workflow, examine the integration requirements and define a practical scope for the build.
- A mutual NDA is signed before project details are shared.
- Scope is fixed in writing before any build starts.
- You own the source code, the IP and the documentation at delivery.
- Support plans are available and tailored on a discovery or technical call.