1. Scope
This document sets out FLOWA PAY INC.'s policy position and control objectives, published for transparency and to support institutional due diligence. It is reviewed periodically and does not constitute legal advice. FLOWA PAY INC. makes no representation that it holds any licence, authorisation or certification except the FINTRAC Money Services Business registration expressly stated in the Regulatory Disclosures.
Where Flowa Pay processes, stores or transmits cardholder data, it does so within an environment engineered to the Payment Card Industry Data Security Standard (PCI DSS).
2. Status
In progress. Formal PCI DSS attestation is targeted before launch. Until then, no PCI compliance level should be inferred. We reduce scope through tokenization and by minimising card-data handling.