AcquirerOS Payment Gateway for WooCommerce

AcquirerOS Payment Gateway for WooCommerce adds an AcquirerOS-compatible payment method to classic WooCommerce checkout and the WooCommerce Checkout Block.

For new installations, Redirect / Hosted Checkout is the recommended and default mode. Customers enter card data on the hosted payment page rather than directly in WordPress. S2S / Direct API remains available as an advanced option for merchants that are specifically prepared to meet the applicable PCI DSS obligations.

Payment modes

• Redirect / Hosted Checkout (Recommended): WordPress sends order and customer information to the configured Hosted Checkout endpoint and redirects the customer to the returned payment URL. Card number, expiry date and CVV are not collected by this plugin in Redirect mode.
• S2S / Direct API (Advanced): Card number, expiry date and CVV are entered in WooCommerce and sent server-to-server to the configured payment endpoint for authorization. Merchants using this mode are responsible for confirming their PCI DSS scope and obligations with their payment provider and qualified compliance advisers.

External service

This plugin connects to the payment endpoint configured by the merchant in WooCommerce > Settings > Payments > AcquirerOS. The service is required to create and process payment transactions.

Depending on payment mode and transaction requirements, information sent to the configured endpoint can include order number, order amount, currency, product/order item information, billing and shipping details, customer name, email address, phone number, IP address, browser/user-agent information, callback URLs, and transaction identifiers. In S2S / Direct API mode only, card number, expiry date and CVV/CVC are also transmitted to the configured payment endpoint for payment processing.

AcquirerOS service: https://acquireros.com/

AcquirerOS Privacy Policy: https://acquireros.com/privacy/

AcquirerOS Terms of Service: https://acquireros.com/terms/

Merchants should publish appropriate privacy disclosures and ensure their use of the configured payment service complies with applicable laws, contractual requirements, and payment-card security requirements.

Security notes

• Hosted Checkout is the default mode for new installations.
• Card numbers and CVV/CVC are not stored in WordPress order metadata by this plugin.
• Diagnostic logs do not contain card numbers or CVV/CVC.
• Payment callbacks use per-order random callback tokens.
• Asynchronous notify callbacks require a valid gateway signature.
• Callback merchant, gateway, order number, amount and currency are checked before an order is updated.
• Notify callbacks accept POST requests only.
• Payment endpoints must use public HTTPS URLs.
• Duplicate successful callbacks are handled idempotently through WooCommerce payment status checks.