Payment processing platforms — how BazPay's architecture is put together.
BazPay is an online payment processing platform for merchants across the EU, UK, Australia, Canada and New Zealand. Acceptance, tokenisation, fraud scoring, settlement and reporting share one REST API, one signed webhook envelope and one interchange++ statement — with direct regional acquiring in the same stack, not stitched from separate vendors.
Built for EU, UK and Commonwealth e-commerce sellers, subscription software firms and professional-services companies. Multi-tenant SaaS, regional-hosted, with PCI DSS Level 1 on the platform.
Why a unified platform beats a stitched stack
Four things stay true once monthly volume is worth reconciling line by line. They are the reasons product, engineering and finance teams stay on a unified platform after the integration cost is paid.
-
One unified data model
Cards, wallets, local APMs and SEPA Instant all resolve to the same charge object. Your application code, your billing service and your finance ledger read the same shape whichever rail moved the money.
-
One event catalogue
Every state change — authorised, captured, settled, refunded, disputed — arrives at your webhook endpoint under one HMAC-signed envelope. One handler, one secret, one replay policy across every rail.
-
Direct regional acquiring in the same stack
The processing platform and the acquirer are the same entity. No external gateway hop, no reseller layer between authorisation and settlement, no split boarding across two vendors.
-
Ops built for online traffic
Retry-safe idempotency on every write, sub-second scoring inline with authorisation, and observability that surfaces the exact decline code within seconds of the shopper's response.
The four layers of the processing platform
Every online payment processing platform decomposes into four layers. Understanding the layers separately is how you evaluate one honestly — and how you avoid buying an authentication engine dressed as a full platform.
-
API
REST API surface
The application layer of the online payment processing platform. One endpoint creates a charge; the payment_method field routes to a card, wallet, APM or bank rail. Idempotency-Key on every create keeps retries safe. Complete schema in the API reference.
- REST
- Idempotency
- Rate-limits published
-
Runtime
Processing runtime
The engine that scores, authorises and captures. Inline fraud rules run before the acquirer sees the request. PSD2 exemption logic decides on 3-D Secure 2.2 per charge. Every stage is logged with its own event ID.
- Scoring
- 3-D Secure
- Auth + capture
-
Vault
Gateway-side vault
Card credentials are tokenised at first entry inside the platform's PCI DSS Level 1 environment. Network tokens refresh automatically when a card is reissued. Your stack receives a token, not a PAN.
- Vault tokens
- Network tokens
- SAQ A
-
Delivery
Event and reporting layer
Signed webhooks push every state change to your service. Interchange++ statements and real-time analytics deliver the finance and product view of the same data, keyed to the same charge ID.
- Webhooks
- Interchange++
- Real-time analytics
Cluster context: the network payment gateway layer describes the reach across rails; merchant acquiring describes the licence side; this page describes the software architecture. Adjacent surface: payment processing software, transaction processing and gateway services.
Evaluation criteria for online payment processing platforms
The right way to shortlist any processing platform is to compare the same criteria across candidates. Below is the shortlist BazPay uses in customer conversations, with our own answer on each row.
| Criterion | BazPay | Common alternative |
|---|---|---|
| Deployment model | Multi-tenant SaaS, regional-hosted | Self-hosted or vendor-hosted per contract |
| Data model | Rail-agnostic charge object | Rail-specific object per method |
| Event stream | One signed webhook envelope | Different envelopes per rail |
| PCI posture | PCI DSS Level 1 on the platform | Merchant-hosted fields common |
| Vault ownership | Gateway-side vault, portable | Bring-your-own or vendor-locked |
| Ops model | Managed platform, dashboard configuration | In-house ops, engineering release |
| Underwriting | Merchants across the EU, UK, Australia, Canada and New Zealand (explicit list) | Broad, few exclusions |
Buyer's-comparison detail on the payment processors page. Rate structure on the pricing page. Plugin coverage on integrations.
How the platform handles one online payment
Six stages sit between the checkout button and the settled dollar on your bank account. Each stage is visible in the dashboard and each stage change fires a signed webhook.
-
Initialise
The checkout script loads hosted fields and collects device signals before any request leaves the browser.
-
Score
The inline rule engine grades the request against your rule set. Clean orders skip the extra step.
-
Authenticate
3-D Secure 2.2 runs when the risk earns it; PSD2 exemption logic claims risk analysis, low-value or MIT where the rules allow.
-
Authorise
The charge posts to the acquirer with the authentication result and CAVV bound to the transaction for issuer scoring.
-
Deliver
The signed webhook fires. Your service updates the order idempotently on the event ID.
-
Settle
Funds reconcile per scheme cycle to your local settlement account. Interchange++ line detail lands on every statement row.
Platform features engineered for online payment processing services
Every capability below ships on the standard integration. Turn features on with a request flag or a dashboard toggle — no enterprise-tier gate on the primitives.
-
REST API
One endpoint reaches every rail. The response shape does not change between cards, wallets, APMs or SEPA Instant.
-
Idempotent writes
Idempotency-Key on every create. Retry any request safely — the second call returns the first response byte-for-byte.
-
Signed webhooks
HMAC-signed, replay-protected events with monotonic IDs and exponential retry for up to 72 hours.
-
Hosted fields
Card, expiry and CVC inputs served from our PCI environment inside your checkout, keeping merchant scope at SAQ A.
-
Network tokens
Visa and Mastercard network tokens replace PAN at storage; automatic refresh keeps saved cards alive after reissue.
-
3-D Secure 2.2 engine
Frictionless flow first; PSD2 exemption logic runs automatically against your rule set.
-
Rule engine
Compose triggers on 30+ enriched fields. Publish rule changes from the dashboard — no engineering release required.
-
Interchange++ reporting
Every settled transaction breaks out interchange, scheme fees and processor margin for finance reconciliation.
One REST call, one canonical charge object
The charge is the atomic unit of the online payment processing system. One endpoint authorises, captures and refunds. Idempotency keys make retries safe. Signed webhooks confirm every state change asynchronously — even if your service was down when the event fired.
POST /v1/charges
Idempotency-Key: 8f1c-2b3a-9e4d
{
"amount": 4990,
"currency": "EUR",
"payment_method": "card",
"capture": "auto",
"three_d_secure": "required_if_needed",
"customer": "cus_5F9k",
"metadata": { "order_id": "ORD-10842" }
}
Switch payment_method to ideal, apple_pay or
sepa_debit and the request routes to the corresponding rail. The response
object retains the same shape. Full schema in the API
reference; handler samples in the developer docs.
Merchant profiles the platform is scoped for
BazPay underwrites merchants in the EU, UK, Australia, Canada and New Zealand. Underwriting is scoped to four merchant profiles with predictable chargeback ratios and clean AML posture — if your model fits, boarding takes days.
-
E-commerce sellers
DTC brands and multi-country storefronts on Shopware, Magento 2, WooCommerce or PrestaShop — one processing platform across every regional market.
-
Subscription software
SaaS teams billing monthly and annual plans with card-on-file renewals, MIT exemptions and dunning-aware retries.
-
Professional services
Higher-ticket B2B invoicing with named-payer trust lists and enforced 3-D Secure 2 above a ceiling you set.
-
Digital publishers
Membership renewals, single-issue purchases and paywall unlocks reconciled per SKU on the same platform ledger.
Out of scope for BazPay: adult, gambling, cannabis, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection and MLM. BazPay is not a merchant of record and not a marketplace of third-party PSPs.
Security and compliance signals
The platform runs inside a PCI DSS Level 1 environment assessed each year. Hosted fields, network tokens and gateway-side vaulting keep your annual return at merchant SAQ A. Authentication runs on every card charge with automatic exemption logic where the rules allow.
- PCI DSS Level 1
- Annual assessment on the processing and acquiring environment
- Merchant SAQ A
- Hosted fields and network tokens keep card data out of your stack
- Authentication
- 3-D Secure 2.2 with automatic exemption logic on every card charge
- GDPR
- In-region data residency; DPA on request
- SEPA / SEPA Instant
- Direct participation for merchant payouts in supported corridors
- Scheme registrations
- Visa VIRP and Mastercard SPoC/PCI-CP where required
Questions engineering and payments teams ask
What defines a payment processing platform, as opposed to a single processor?
A processor moves one authorisation message. A payment processing platform is the wider software system that unifies acceptance, tokenisation, fraud scoring, settlement and reporting behind one API, one dashboard and one event stream. BazPay is that platform for merchants across the EU, UK, Australia, Canada and New Zealand — acceptance, billing and payouts share a rail-agnostic charge object.
How does BazPay's online payment processing platform compare with stitching several vendors?
Stitching several vendors keeps each specialised, but multiplies the integration surface, the reconciliation surface and the compliance surface on your side. A unified processing platform collapses those into one contract, one signed webhook envelope and one interchange++ statement. Fewer moving parts, less coordination cost, one place to look when something breaks.
Is the platform multi-tenant, single-tenant or self-hosted?
Multi-tenant SaaS, regional-hosted. The environment is shared but data isolation is enforced per merchant, and each merchant contracts with a named MID at the schemes. Self-hosted and single-tenant deployments are not offered — a managed platform is the model that keeps PCI DSS Level 1, 3-D Secure 2.2 and scheme registrations current without engineering burden on your team.
How do I integrate the online payment processing system?
Sign up for a sandbox key, either drop in one of the maintained plugins for WooCommerce, Magento 2, PrestaShop or Shopware, or call the REST API directly. Create a charge, verify the signed webhook, and repeat for capture and refund. Sample flows and event payloads live in the developer docs; the endpoint schema lives in the API reference.
What data does the platform hold, and where does it live?
Card credentials sit in a gateway-side vault under PCI DSS Level 1. Charge, refund, dispute and settlement records live in the platform database. Data residency is regional. A DPA is available on request through the company page.
How reliable is the webhook delivery on the platform?
Every event carries an HMAC signature over the raw body, a timestamp header for replay protection and a monotonic event ID for deduplication. Failed deliveries retry on an exponential schedule for up to 72 hours. Your endpoint should be idempotent on the event ID.
Do the online payment processing services extend to payouts and reporting?
Yes. Payouts run on SEPA and SEPA Instant to your local settlement account, with SWIFT and push-to-card options on approved corridors. Reporting comes as interchange++ line detail on every settled transaction and real-time analytics on approvals, declines and disputes.
Which merchant profiles is the platform designed for?
Merchants across the EU, UK, Australia, Canada and New Zealand: e-commerce sellers, subscription software firms, professional-services businesses and digital publishers. BazPay does not board adult, gambling, cannabis, CBD, nutraceutical, forex, CFD, crypto-exchange, debt-collection or MLM merchants, and it is not a marketplace of third-party PSPs.
Put the platform on the shortlist
Share your architecture, volumes and existing stack. A payments specialist will map the integration — card and APM processing, payment fraud prevention, recurring billing, payouts and open banking — with you.