ezpymtResearch
Trust Center

Controls you can inspect.

Security, privacy, and model governance behind every payment decision. Compliance is one of the five gates.

Enabled controls and current evidence are confirmed for each deployment. It is not an independent audit or certification.

Four pillars

Control areas to review for your deployment and regulatory scope.

Data-boundary controls

Model endpoints, allowed fields, and residency requirements are selected for each deployment and verified before sensitive data is enabled.

Approved model endpoints

Use only configured model endpoints and approved data fields. Contracts, logging, and retention remain part of deployment review.

Isolated environments

Test and Live are separated. Account, network, database, key, and edge controls are evidenced against the environment being reviewed.

Defense in depth

Layered edge, identity, network, data-access, secret, encryption, and audit controls. Enabled controls are confirmed from deployment evidence.

Compliance posture

Framework mappings are not certifications. Request current evidence for the deployment and scope under review.

PCI-DSS 4.0
Scope reviewed per deployment
CIS Benchmarks
Control mapping available
GDPR / CCPA
Control mapping available
FinCEN CDD (31 CFR 1010.230)
Control mapping available
NIST AI RMF 1.0
Control mapping available
SR 11-7 (Fed Model Risk Mgmt)
Control mapping available
EU AI Act
Control mapping available
ISO/IEC 42001
Not certified

Responsible AI controls

Review the applicable model-risk frameworks and current control evidence with our team.Request the Responsible AI Statement.

Human accountability first

Configured agent changes use explicit ownership, human review, kill switches, and maker-checker controls where required.

Decision audit trail

Decision records capture the inputs, outcome, reason codes, version, and integrity evidence available for the configured path.

Deterministic fallback

Required deterministic gates fail closed. Optional model assistance cannot replace a required verdict.

Sensitive-data controls

Sensitive-field allowlists and tokenization rules are reviewed before a model endpoint is enabled.

Subprocessors

Third-party services that may process customer data on ezpymt's behalf. Request the named providers, applicable agreements, data locations, and current scope before onboarding.

SubprocessorPurposeRegion
Primary cloud providerHosting, secure storage, and approved model assistanceUS regions
Card / ACH processorCard and ACH money movementUS
Bank verificationBank account ownership and risk signalsUS
DNS providerAuthoritative DNSGlobal

Shared responsibility

Infrastructure provider

Physical hosting security and contracted service availability, subject to provider scope.

ezpymt

Payment controls, application security, model governance, and decision evidence within the agreed scope.

You

User access, business data classification, integration credentials, customer notice, and consent.

Incident response

  1. Assess the incident and contain affected activity.
  2. Review impact and coordinate corrective action.
  3. Notify affected parties under applicable law and agreement terms.
  4. Review the cause and verify corrective controls.

Contact & reporting

Direct routes for security, privacy, risk, and Responsible AI inquiries.

Security incidents
security@ezpymt.com
Response terms by agreement
Privacy / DSAR
privacy@ezpymt.com
Handled under applicable law
Bank/FI risk
risk@ezpymt.com
Evidence available on request
Responsible AI
responsible-ai@ezpymt.com
Response terms by agreement