ProcessOut

What ProcessOut is

ProcessOut is a payment orchestration platform founded in Paris in 2015 by Cyril Chemla, Gregoire Lemercier and Jeremy Lejoux. The company joined the Checkout.com group in 2020 and continues to provide a vendor neutral layer above traditional Payment Service Providers. Through a single API, ProcessOut enables merchants to vault cards once, connect dozens of PSPs (Stripe, Adyen, Worldpay, Braintree, PayPal, Klarna, GoCardless and others), apply smart routing rules in real time, run controlled experiments on PSP performance and consolidate reporting in a unified analytics dashboard.

What data and cookies ProcessOut sets

In the checkout flow, ProcessOut sets technical cookies and tokens used by its hosted iFrame for tokenisation, anti CSRF protection and 3D Secure session continuity. It processes card primary account numbers (PAN), expiry, CVV, cardholder name, billing address, IP address, device fingerprint and transaction metadata. Card data is tokenised and stored in a PCI DSS Level 1 vault. On the merchant dashboard, additional cookies are used for authentication, preferences and product analytics.

GDPR and ePrivacy implications

ProcessOut acts as a processor or joint controller depending on the use case. Payment execution is grounded in contractual necessity, while fraud prevention relies on legal obligation. Smart routing decisions are profiling activities that must be documented, and customers retain rights to information, access, rectification, restriction and objection. Cookies set by the checkout iFrame are strictly necessary and exempt from consent, while cookies on the merchant dashboard are subject to standard consent rules.

Consent requirements

No consent is required to process the payment itself, since this is necessary to execute the contract. Consent is required for non essential analytics or marketing cookies that ProcessOut or your dashboard tooling sets. For storing card credentials for future purchases (card on file), you must rely on contract or explicit opt in from the customer at the checkout step.

Data transfers

ProcessOut hosts its core vault and routing engine in the European Union. As part of the Checkout.com group, some operational data flows through UK and US infrastructure. Most importantly, routing transactions to PSPs such as Stripe US, Braintree or PayPal involves transfers of cardholder data outside the EEA. Standard Contractual Clauses, the EU US Data Privacy Framework and an active transfer impact assessment are necessary, along with PSP specific contractual safeguards.

Practical compliance steps

Sign the ProcessOut and Checkout.com DPA, list the connected PSPs in your transparency notice with their respective transfer mechanisms, document the routing logic and profiling in the record of processing activities, perform a DPIA covering card vaulting and smart routing, limit cardholder data retention to the strict PCI DSS minimum, restrict dashboard access through SSO and MFA, and verify that the checkout iFrame loads no marketing cookies before consent.