Card numbers never touch our servers.
Every payment on ThunderTix is tokenized by a PCI Level 1 processor. Your patrons' card details go to the processor, and ThunderTix keeps only a token for refunds and reconciliation.
We have protected venues and their patrons since 2005. This page explains how.
Payments stay with the processor.
Card data goes straight from the patron to a PCI Level 1 processor.
Tokenized payments
Stripe, Square, Authorize.net, Elavon, Moneris, or Braintree hold the card. ThunderTix keeps only a token.
Secure payment fields
Online checkout uses the processor's secure iframes. In person, staff use PCI-validated readers like Stripe M2, WisePOS E, and Square Terminal.
Your money, your account
Sales are deposited by your processor into your organization's own account.
Filtered, encrypted, and private.
ThunderTix runs on Amazon Web Services behind Cloudflare.
Cloudflare DDoS & WAF
All traffic passes through Cloudflare's DDoS protection and web application firewall (WAF) before it reaches ThunderTix.
Encrypted in transit
Every connection uses TLS 1.2 or higher.
Private databases
Production databases are not reachable from the internet. Staff access runs through an audited, MFA-protected connection.
Only the right people, with proof.
Access to our systems requires more than a password.
Multi-factor everywhere
MFA is required for our cloud infrastructure and for every member of our code repository.
Hardware security keys
Our most privileged account is protected with a physical security key.
Least-privilege access
Production access is limited to authorized engineers and granted by role.
Every change is reviewed.
Nothing reaches production without another engineer's approval.
Reviewed before release
Every change to our main codebase needs a reviewer's approval and passing automated tests. No one can bypass it.
Scanning and patching
Our code and its dependencies are scanned for known vulnerabilities, and new high-confidence findings block the change. Updates are applied under our patch management policies.
Quarterly ASV scans
HackerGuardian, a PCI Approved Scanning Vendor (ASV), scans our public systems for vulnerabilities every quarter as part of PCI compliance.
Watched, logged, and ready.
Automated threat detection, a full audit trail, and a plan with names on it.
Threat detection
AWS GuardDuty and Security Hub watch our infrastructure and alert our team.
Complete audit trail
Administrative activity is logged, and the logs are validated so they can't be quietly altered.
Incident response plan
A written plan with a named Incident Commander and a backup on call every week.
Your patrons are yours.
We protect patron data and never sell it.
Never sold
We never sell patron data. It's shared only with the services that run ThunderTix, like your payment processor.
Patron privacy requests
Access, opt-out, and deletion requests are supported, in line with GDPR and CCPA.
Data Processing Addendum
A customizable DPA is available for your organization.
Read our full policies: Privacy Policy for ticket buyers and ThunderTix Privacy Policy for venues.
Six PCI Level 1 processors. You choose.
ThunderTix works only with PCI Level 1 payment processors and PCI-validated card readers.
| Provider | Function | PCI Level 1 | Tokenization | Validated card readers |
|---|---|---|---|---|
| Stripe | Payment processing | ✓ Yes | ✓ Yes | Stripe M2, Stripe Reader S700, WisePOS E, BBPOS Chipper 2X |
| Square | Payment processing | ✓ Yes | ✓ Yes | Square Terminal, Square Reader |
| Authorize.net | Payment gateway | ✓ Yes | ✓ Yes | – |
| Elavon | Payment gateway | ✓ Yes | ✓ Yes | – |
| Moneris | Payment gateway | ✓ Yes | ✓ Yes | – |
| Braintree | Payment gateway | ✓ Yes | ✓ Yes | – |
ThunderTix mobile apps use Stripe's official iOS and Android SDKs to accept in-person payments on PCI-validated readers. Supported card readers must be PCI-validated models running up-to-date firmware, following each manufacturer's guidance.
Need documents for your board or IT team?
We'll send any of these on request, usually within one business day.
- PCI DSS v4.0 SAQ-D for Service Providers (2026)
- HECVAT
- Data Processing Addendum
- Infrastructure and incident response summary
- Accessibility conformance report (VPAT)
- Privacy Policy for ticket buyers
- ThunderTix Privacy Policy for venues
Security FAQ
Does ThunderTix store credit card numbers?
Is ThunderTix PCI compliant?
Does ThunderTix have a SOC 2 report?
Which payment processors can we use?
How do we request security documentation?
See it for yourself.
Start a free trial with no time limit, or book a demo and bring your security questions.