Trust & Compliance
Payment security and regulatory compliance
Card data is the one part of your operation where “we’ll get to it” is expensive. Here’s what HungerRush handles, and what stays your responsibility.
Secure payments
The payment path is designed to reduce exposure
HungerRush protects cardholder data from the moment a guest presents a card through authorization and any later stored reference. The controls below reduce the systems and people that ever come into contact with usable card data.
Encryption at the point of entry
Card data is encrypted inside the reader before it reaches the terminal, so clear cardholder data never sits on your POS or your network.
Tokenization
Stored card references are tokens, not card numbers. A token is useless outside the transaction it belongs to, which removes the value from a would-be breach.
Certified devices
In-person payments run on PCI PTS-certified readers with tamper detection, supporting EMV chip, contactless tap, and mobile wallets.
Secure transmission
Transaction data moves over current TLS, and platform access is controlled with role-based permissions down to the individual employee.
Who owns what
PCI compliance is shared. HungerRush secures the payment technology; the restaurant still controls its environment and annual attestation.
| Standard or control | What it covers | Primary owner |
|---|---|---|
| PCI DSS | The baseline requirements for anyone who stores, processes, or transmits cardholder data. | Shared |
| PCI PTS | Device-level certification for PIN entry and card-reading hardware. | HungerRush |
| EMV | Chip-card acceptance and the controls that shift counterfeit-fraud liability. | HungerRush |
| P2PE / encryption | Point-to-point encryption from the reader through to the processor. | HungerRush |
| Self-Assessment Questionnaire | The annual PCI attestation for the restaurant’s own environment. | Restaurant |
| Network & premises security | Wi-Fi segmentation, firewall configuration, physical access, and staff practices. | Restaurant |
What stays the restaurant’s responsibility
Complete your annual SAQ
Validated technology narrows which questionnaire applies, but the attestation is still yours to file each year.
Segment your network
Keep guest Wi-Fi separate from payment devices, and change default router credentials.
Control physical access
Inspect readers for tampering, and limit who can reach terminals and cash drawers after hours.
Train and offboard staff
No shared logins, no written-down card numbers, and permissions revoked the day someone leaves.
Payment security questions
HungerRush processes payments through PCI DSS-validated infrastructure and PCI PTS-certified card readers, and maintains current attestations for the parts of the payment path it operates. PCI compliance is a shared responsibility, so your restaurant still completes its own annual attestation for its environment. Contact HungerRush for current compliance documentation.
No. Using validated payment technology substantially reduces your PCI scope—often to a simpler questionnaire—but every merchant that accepts cards remains responsible for its network, devices, staff practices, and annual self-assessment.
No. Card data is encrypted inside the reader before it reaches the terminal and replaced with a token for any stored reference, so clear card numbers are not retained on your POS or local network.
Because card data is encrypted at the reader and tokenized in storage, there is far less usable card data to expose. Specific liability depends on your merchant agreement and compliance posture; review both with HungerRush and your processor.
Yes. In-person payments accept EMV chip, contactless tap, swipe, and mobile wallets including Apple Pay through PCI PTS-certified readers.
Yes. Guest-led checkout runs through the same encrypted, tokenized payment path as in-person transactions and avoids the card handoffs that create fraud exposure at the counter.