Data handling and compliance
What personal and business data onboarding collects, how sensitive numbers are returned masked, and how to keep your API key safe.
To approve a business, Priority must confirm who the business is and who owns and runs it. That means you send sensitive data, such as tax IDs and bank account numbers. Share this page with your security or compliance team when they review your integration. It states only what the boarding contract confirms; anything set by policy is flagged for your security and compliance teams to confirm.
What you send
Onboarding collects the identity data Priority needs to approve a business before it can process payments:
- The business: legal name, business type, incorporation details, tax IDs, industry, and contact details.
- The people behind it: owners and signatories, each backed by a shared individual, with name, date of birth, nationality, tax ID (SSN or ITIN), and one or more government IDs, such as a driver license.
- Where it operates and gets paid: business addresses, locations and their processing profiles, and bank accounts.
A tax ID can be an EIN, an SSN, or an ITIN. An EIN is a US tax number for a company, an SSN is a Social Security number, and an ITIN is a US tax number for people without an SSN. You send this data so underwriting can verify the business and the people who own and control it. See Businesses for the full model and Business validation and KYB rules for the rules it must satisfy.
How sensitive numbers come back
You send sensitive numbers in full. When you read the record, onboarding returns only the last four digits.
| You send | You get back |
|---|---|
Bank account number (accountNumber) | accountNumberLast4 |
Business tax ID (taxIds[].value) | taxIds[].lastFour |
Individual tax ID (taxId.value) | taxId.lastFour |
Government ID number (governmentIds[].number) | numberLastFour |
When you update a record, send only the fields you're changing, not the masked values you read. See API error handling.
Keep your API key safe
- HTTPS. Send requests only to the HTTPS base URLs in Getting started.
- API key per request. Every endpoint authenticates with an API key in the
x-api-keyheader (x-api-key: <your-key>). To get or rotate a key, contact Priority support. Keep the key on your server; never put it in a browser or mobile app.
For your security and compliance review
The boarding contract does not define the following. Route each to your Priority Commerce contact so your security and compliance teams can confirm it directly:
- Data retention periods.
- Encryption in transit and at rest.
- PCI DSS and SOC posture and attestations.
- Data residency and sub-processor commitments.
See also
- Getting started: access, authentication, and base URLs
- Businesses: the identity data model and how the resources relate
- Business validation and KYB rules: the KYB rules a business must satisfy
- API error handling: masked and read-only field behavior
Updated 9 days ago