Ryvx

Many shop owners assume Stripe, PayPal or their card provider takes care of security. Those providers protect the card details. Your site still holds customer accounts, names, addresses, order history and discount codes, and the way your checkout works is down to you.

What goes wrong on shop sites

These problems turn up again and again. A customer changes a number in the address bar and sees someone else's order. The checkout trusts a price or quantity sent from the browser. Discount codes can be guessed or reused without limit. Password reset links can be reused or guessed. An admin page or a plugin left over from setup is still reachable. Each one leaks data or money, and a scanner rarely catches them because it never places an order.

What your payment provider covers

If your card form is hosted by the payment provider, card numbers never touch your server, which narrows what PCI DSS asks of you. It does not cover your login, your customer accounts, your order pages or your admin area. UK GDPR still applies to the personal data in all of those.

What a test should cover

Ask for a test that signs in as a customer, places test orders, and tries to see or change other customers' data. It should try to tamper with prices and discounts at checkout, test password reset and account takeover, and look for admin pages and old plugins that should not be public. It should do all of this without placing real orders or changing live data unless you agree to it in advance.

How Ryvx tests a shop

A Ryvx Launch Security Review costs £495 per site and looks for these problems. Nothing is tested until you prove the site is yours and agree the scope in writing, and anything that could change your data stays off unless you switch it on. A finding only goes in the report with working proof, a person checks every report, and you get it in 3 to 5 working days with one retest after you fix things.

Ryvx is not a PCI Approved Scanning Vendor. If your acquirer asks for quarterly ASV scans, you still need those from an approved vendor.