March 2026 Summaries

Basis Theory announced it has achieved ISO/IEC 27701 certification, an international standard for Privacy Information Management Systems that extends security management into accountable handling of personally identifiable information and related privacy rights. The certification independently audits processes including feature development and sub-processor management, aiming to help customers meet requirements under frameworks such as GDPR and CCPA while reducing compliance work. The company also participates in the EU-U.S. Data Privacy Framework to provide a legal mechanism for European customers transferring data to U.S.-based infrastructure. Basis Theory says its Privacy by Design policy incorporates privacy considerations early in product development and that it will continue evolving its practices as privacy requirements change.

Global expansion often pushes merchants beyond a single payment service provider, as bundled platforms such as Stripe or Adyen can simplify initial launches but may become costly or limiting across regions, payment preferences, and high-risk industries. A multi-processor strategy can improve transaction approval rates, lower processing costs, and provide access to local acquiring relationships and alternative payment methods, but it also requires effective routing of payments among providers. The passage argues that independent, programmable payment vaults and tokenization can help merchants store customer data securely, reduce PCI-DSS compliance scope, and move transactions between processors without disrupting customers, citing B2B subscription platform Maxio’s international expansion as an example. Merchants can then use either third-party orchestration platforms or internally built decisioning systems to route payments based on factors such as approval likelihood, fees, chargeback exposure, and volume commitments.

Basis Theory has redesigned its Developer Portal to make product evaluation and testing faster, more intuitive, and less dependent on support, with the aim of helping engineers develop confidence in the platform and advocate for adoption internally. The update modernizes the underlying technology stack, simplifies navigation and UI flows by reducing unnecessary steps and modals, and creates a more consistent foundation for future capabilities. The company also introduced an AI-assisted development workflow that uses product requirements to accelerate implementation, documentation, issue triage, and incorporation of user feedback. Users are encouraged to test both basic functions, such as creating tokens and calling the Proxy, and more complex workflows or edge cases, with the portal positioned as a streamlined environment for evaluating Basis Theory alongside alternatives such as IXOPAY and VGS.

Basis Theory’s monthly update introduces a public preview of the Node.js 22 runtime for Reactors and Proxy Transforms, alongside multi-merchant support for Account Updater and Network Tokens. Customers can now supply an optional merchant_id to manage separate Account Updater and Network Token configurations for multiple merchants or business units within one tenant, avoiding the previous need for separate tenants while retaining backward compatibility through tenant-level settings when no merchant ID is provided. The release also resolves issues affecting Proxy handling of 520 destination responses, card-details result ordering, Token Intents errors, and Elements initialization, autofill styling, and card expiry deletion. Additional Elements enhancements allow CardElement card-brand icon positioning or removal and make CVC input masking configurable. The update also notes the company engineering team’s 2026 offsite visit to Playa del Carmen and Chichén Itzá.

BIN data, derived from the first six or eight digits of a payment card number, identifies characteristics such as card network, issuer, type, issuing country, prepaid status, and—in enhanced forms—account and processing-cost details. The material presents it as an underused tool for high-volume merchants seeking to improve authorization rates, fraud prevention, payment routing, and interchange costs without changing customer checkout experiences. BIN information can identify potentially risky patterns, such as geographic mismatches, prepaid cards used for high-value purchases, or cards subject to merchant-category restrictions, while also helping route transactions to providers with stronger approval rates for particular cards or regions. It can further identify cards eligible for Level 2 or Level 3 transaction data, allowing merchants to submit required line-item, tax, and purchase-order details to qualify for lower interchange rates. Basis Theory promotes embedding standard and enhanced BIN enrichment into its payment-token vault so that these attributes are available across fraud checks, routing decisions, and transactions without separate API calls.

Developer documentation in payments should be treated as a product component that helps users build reliable integrations under real production conditions, including retries, expired cards, out-of-order webhooks, and network failures. Drawing on insights from Basis Theory’s Director of Solutions Engineering, Davi Aquino, the discussion advocates for empathetic, task-first documentation that prioritizes what readers are trying to accomplish rather than assuming familiarity with product-specific terminology or presenting feature-focused overviews. Effective guides should use quickstarts, workflow diagrams, consistent navigation, and a before-to-after structure that explains the user’s current state, desired outcome, business or technical rationale, implementation steps, and verification methods. Documentation should also explain why safeguards such as idempotency keys, verification, order-independent webhook handling, and token portability matter, helping prevent fragile implementations. A strong payments quickstart includes prerequisites, baseline code, a successful request-and-response path, confirmation methods, common errors, and clear next steps toward production readiness, reassuring engineering, product, and security stakeholders that the integration can be implemented safely.

Non-processor endpoints are APIs and service connections that manage important tasks surrounding an e-commerce payment without submitting the transaction itself, including fraud screening, customer identity verification, payment routing, subscription billing, and payment-method updates. Their growth reflects increasingly complex online commerce, with marketplaces such as Walmart and Amazon expanding APIs that connect payments to fulfillment, inventory, and merchant operations. These tools do not replace payment service providers, card networks, or banks, which still authorize and settle transactions, but they can reduce fraud and checkout friction while helping merchants select processors based on approval probability, fees, and chargeback risk. Fraud platforms can score tokenized payment data before authorization, while marketplace and digital-wallet integrations can apply eligibility and fulfillment logic without broadly exposing raw card details. For merchants using multiple processors, a programmable payment vault can centralize and protect payment credentials, enabling greater flexibility across providers and payment methods.

A payments executive with experience at banks, Amazon, Chewy, and a startup argues that control of payment credentials through a secure, processor-agnostic vault is central to merchants’ flexibility, independence, and long-term payment optimization. Drawing on Chewy’s move toward a multi-processor strategy, the author says that although vault infrastructure is essential, most businesses should partner rather than build costly PCI-compliant vault and routing systems internally. The author chose Basis Theory as Chewy’s partner because its architecture enabled a customized payments stack without processor lock-in, then joined the company as Chief Payments Officer after several years as a customer. They contend that increasingly fragmented payment stacks, AI-driven commerce, and evolving concerns over trust, identity, and customer relationships make merchant control of the data layer more important, and position Basis Theory as a platform intended to make enterprise-grade payments capabilities available to a wider range of businesses.

Payment service providers (PSPs) can improve payment approval rates not simply by storing cards, but through bundled services such as credential lifecycle management, network tokenization, authentication, retries, fraud tools, transaction orchestration, and issuer-recognized continuity. The post argues that these capabilities can be separated from a PSP-managed vault, allowing businesses to keep credentials in an independent layer while using multiple processors and specialized providers for authentication, fraud, or routing. This structure can give merchants greater visibility into card metadata, declines, retries, and issuer behavior, enabling them to set their own routing, recovery, risk, and processor-selection strategies rather than relying on generalized PSP defaults. PSP-managed vaults remain useful for early-stage or simple payment setups because they reduce integration complexity, while externally owned credential layers may suit larger businesses seeking flexibility, portability, and lower processor lock-in. Rather than requiring a full migration, such an architecture can be adopted gradually through new credentials, regions, or processor integrations. The post also frames modularity as increasingly important for AI-driven payment optimization, which depends on access to payment signals, the ability to act on them across providers, and feedback loops that bundled systems may limit.