Payment security
When you pay Defera, your card number and security code go straight from your screen into our payment processors' secure card fields. They never reach Defera's servers, and we never store your complete card details.
Here's what happens to your card at each step, from checkout to your last payment.
When you enter your card
- Secure card fields. The card form at checkout and in Update Card is hosted by our payment processor. What you type goes directly to the processor over an encrypted connection.
- A token instead of your card number. The processor gives us a secure token that stands in for your card. We charge your scheduled payments with that token, never with your card number. This is called tokenization.
- Certified processors. Payments are processed by certified PCI-DSS payment gateways. PCI DSS is the card industry's security standard.
What we keep, and what we don't
- What we keep: your card's brand, last 4 digits and expiration date, so you can see which card is on file, along with the secure token and your payment history.
- What we never keep: your full card number or its security code (CVC).
Changing your card
- Saved cards are replaced, not edited. For security, a saved card can't be changed in place. Update Card takes the full card details in one secure flow and replaces the old card.
- One place to change it. Update Card is the only place to change your card: open Trips, tap your trip, then tap Update Card in the Payment Schedule section.
- Nothing changes if an update fails. If an update doesn't go through, the card already on file keeps being charged on schedule.
Behind every payment
- Verified payment messages. When a payment processor tells our systems that a payment went through or failed, we check the message's signature before we act on it, so a forged message is ignored.
- Refunds go back to the card you paid with. A refund can't be redirected to a different card, a bank account or anyone else.
- Every payment is on your trip. Your trip's Payment Schedule shows your payments, so you can check any charge against it.
How you pay, and how you never pay
We take debit and credit cards. We'll never ask you to pay for a Defera trip by wire transfer, bank transfer, payment app, gift card or cryptocurrency. If someone asks you to pay that way, it isn't Defera. Avoiding scams explains what to do.
See a charge you don't recognize?
Start by checking it against your trip's Payment Schedule. A charge I don't recognize shows how. If something still looks wrong, chat with the Defera Concierge or email support@defera.app. If you think your card details were stolen, call your bank too.