# Venue software security and data handling > Venue software security and data at VenueOra: a PCI DSS Level 1 acquiring partner, tokenisation, 3-D Secure 2, encryption, UK storage and 30-day deletion. Canonical page: https://venueora.com/security Security for venue software comes down to facts: who holds card data, who can see what in the dashboard, where personal data is stored and when images are deleted. Here they are for VenueOra, LockerPay and VenueGo, a verification platform designed for venues. ## How it works 1. Merchant verified before live payments: Before a venue takes live payments or receives payouts on VenueOra, it completes merchant verification, the KYC step, and enters bank details. Until that is done, the venue cannot take live payments or receive a payout. 2. Card goes to the acquirer: Whether a guest pays online, at a till, at a kiosk or at a locker, card data goes to our PCI DSS Level 1 acquiring partner. Card data never touches your tills, kiosks or lockers. 3. Token, 3-D Secure 2, fraud score: On LockerPay the card is tokenised, so a locker hire, a top-up for a late return or a partial refund runs against a token. 3-D Secure 2 authenticates online and in-app payments and machine-learning fraud scoring runs on every transaction. 4. Settlement and reports: Daily settlement arrives with itemised reports, so finance can match every locker hire or kiosk sale to a payout without seeing a card number. ## What you get - Level 1 acquiring partner: Every card payment across VenueOra, LockVault, our smart-locker service, and LockerPay goes to a PCI DSS Level 1 acquiring partner. Card numbers never touch your tills, kiosks or lockers, and never touch code we host. - Payment security for venue software: On LockerPay payments, tokenisation replaces the card number, 3-D Secure 2 authenticates the cardholder and machine-learning fraud scoring runs as standard. Saved cards in the mobile SDK rely on the same tokenisation. - VenueGo encryption: VenueGo data is encrypted in transit and at rest. Processing runs in London and data is stored in the UK. Images are deleted after 30 days unless a review is open. - Ticketing data, UK-based: Ticketing and membership records are held UK-based. We do not publish a hosting provider or region, and this page claims no certifications; procurement teams who need more can ask us. - Roles, permissions and audit log: Six staff roles, Owner, Admin, Manager, Staff, Accountant and Event Manager, with permissions over members, events, payments, payouts, subscriptions, users, communications, settings, venues and policies. Actions are recorded in an audit log. - Support access, logged: VenueOra support can view a venue as that venue, and every action is logged. That is how we help with a stuck order or a locker without asking for your password, and the audit log records when it happened. ## Outcomes - Nothing to leak from a till: A till, kiosk or locker that is lost or tampered with holds no stored card numbers. The acquiring partner holds the card data, and your hardware only ever sees a result. - Authenticated, scored payments: 3-D Secure 2 and fraud scoring run on LockerPay payments as standard, so a suspicious locker hire or kiosk order can be stopped before it settles rather than disputed afterwards. - Retention you can state: VenueGo images are deleted after 30 days unless a review is open; processing runs in London and storage is in the UK. You can put those three facts in a privacy notice as written. ## Where each product keeps its data Three products, one rule for card data: it goes to the acquiring partner and nowhere else. Beyond that, each product has its own facts, listed here as published. VenueGo reads the document in the camera. It does not look up DVLA, the passport office, or any other government database, and it does not read a passport chip. A clear result is not proof a document is genuine. It does not replace a premises licence, a challenge at the bar, or legal advice. - VenueOra ticketing and memberships: Guest records, tickets, passes and payment history are held UK-based. Payments go to the acquiring partner, payouts follow merchant verification, and roles and permissions decide which staff see payments, members and events. - LockVault and LockerPay: Online and in-app locker payments are tokenised, authenticated with 3-D Secure 2 and fraud-scored. Terminals are certified Android and SoftPOS devices, and the kiosk queue tolerates a dropped connection without losing a transaction. - VenueGo: Face and document images are encrypted in transit and at rest, processed in London, stored in the UK and deleted after 30 days unless a review is open. Results are approved, declined or needs review. - Who can see your venue: Your staff, by role. VenueOra support can view a venue as that venue, and every action is logged, so there is a record of when support was in your account and what was done. This page describes how VenueOra's products handle card data, personal data and age checks. It is not legal advice. Your premises licence conditions and your own data protection assessment take precedence. ## Questions Q: What does venue software security and data handling look like with VenueOra? A: Card data goes to a PCI DSS Level 1 acquiring partner and never touches your tills, kiosks or lockers; LockerPay payments add tokenisation, 3-D Secure 2 and fraud scoring as standard; ticketing and membership data is UK-based, behind six staff roles with permissions and an audit log; VenueGo data is encrypted in transit and at rest, processed in London, stored in the UK, with images deleted after 30 days unless a review is open. Those are the published facts, and this page does not go beyond them. Q: Does VenueOra hold security certifications I can cite in a tender? A: This page does not claim any certification, and you should not cite one on our behalf without written confirmation from us. What we publish is what happens to data: card data goes to a Level 1 acquiring partner, VenueGo data is encrypted in transit and at rest with London processing and UK storage, and ticketing and membership data is UK-based. If a tender needs a named certification, ask us and we will answer plainly. Q: How is card data protected on lockers and kiosks? A: Card data goes from the guest's card or phone to the acquiring partner, and never touches the locker, the kiosk or the code that runs them. LockerPay then works with a token: the authorisation hold at hire, the capture at close-out, a top-up for a late return or a partial refund all run against the token. 3-D Secure 2 and machine-learning fraud scoring apply as standard. Q: Where is VenueGo data processed and for how long is it kept? A: Processing runs in London, data is stored in the UK and everything is encrypted in transit and at rest. Images of the face and the document are deleted after 30 days unless a review is open; while a review is open the images stay until it is closed. The result, approved, declined or needs review, is what reaches your systems by webhook. Q: Where is ticketing and membership data hosted? A: UK-based. We do not name a hosting provider or region on this site. If your council, trust or acquirer needs the detail for a procurement questionnaire, ask us and we will answer directly rather than publish it here. Payouts for ticket and membership sales follow merchant verification and bank details, and card data never touches your tills, kiosks or lockers. Q: Who at VenueOra can see my venue's data? A: Your own staff see what their role allows: Owner, Admin, Manager, Staff, Accountant and Event Manager each carry permissions over members, events, payments, payouts, subscriptions, users, communications, settings, venues and policies, and the Owner assigns roles. VenueOra support can view a venue as that venue, and every action is logged. We use that to fix a stuck order or a locker when you ask, and the audit log records when it happened and what was done. ## Related pages - Leisure centres and trusts: https://venueora.com/industries/leisure-centres - Arenas and stadiums: https://venueora.com/industries/arenas-stadiums - Members' clubs: https://venueora.com/industries/members-clubs - PCI DSS compliance for UK venues and attractions: https://venueora.com/guides/pci-dss-for-venues-and-attractions - Nightclub ID scanning and the data controller: https://venueora.com/guides/nightclub-id-scanning-data-controller - Pricing: https://venueora.com/pricing Book a demo: https://venueora.com/pricing#request