FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
E-commerce

Verifone 2Checkout

PreferencesOfficial website

Verifone 2Checkout is a US/Romanian merchant of record payment platform, operated by Avangate S.A. in Bucharest as part of Verifone Systems Inc. after the 2020 acquisition. It handles global checkout, subscriptions, dunning and EU VAT collection for software, SaaS and digital goods. The hosted checkout on secure.2checkout.com sets only strictly necessary first party cookies. EU customer data is largely processed in EU data centres, with onward US access covered by SCCs and the EU US Data Privacy Framework.

Block Verifone 2Checkout until consentScan my site
Overview

What does Verifone 2Checkout do?

What is Verifone 2Checkout?

Verifone 2Checkout, formerly Avangate / 2Checkout, is a global merchant of record (MoR) payment platform acquired by Verifone Systems Inc. in 2020. The product line is still operated by Avangate S.A. in Bucharest, Romania, with engineering and US operations under the Verifone group. It targets software, SaaS, digital media and online learning companies that need a single MoR partner for global checkout, recurring billing, dunning, tax compliance, fraud prevention and multi currency, multi method payments.

Sellers integrate Verifone 2Checkout either via hosted checkout links, the ConvertPlus inline form or the InLine.js library, which tokenises card data inside an iframe served from secure.2checkout.com.

Cookies and data collected

On the hosted 2Checkout checkout (secure.2checkout.com / secure.avangate.com) only strictly necessary first party cookies are set: a session cookie keeping the cart, a CSRF protection token and a risk cookie used for fraud scoring. When ConvertPlus or InLine.js is used on the seller's page, the iframe still loads on the Verifone domain and the cookies stay first party to that domain. Card data is tokenised within the PCI scope of Verifone and never reaches the seller's servers.

GDPR and ePrivacy implications

Because Verifone 2Checkout acts as merchant of record, it is a controller for the invoicing and tax remittance data and a processor for the seller's customer data. Strictly necessary cookies on the hosted checkout are exempt from prior consent under Art. 5(3) ePrivacy. The customer's active decision to start a purchase is the legal basis for processing the payment data under Art. 6(1)(b) GDPR.

International data transfers

For EU and UK customers, processing happens predominantly in EU data centres (Bucharest, Frankfurt, Dublin). Some operational access from the United States is required for Verifone operations and risk monitoring. The 2Checkout / Verifone DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK International Data Transfer Addendum. Verifone Systems Inc. is self certified under the EU US Data Privacy Framework.

Practical compliance steps

Sign the Verifone 2Checkout DPA from your seller dashboard. Mention 2Checkout (Avangate S.A., Romania, part of Verifone Systems Inc., United States) as merchant of record and processor in your privacy notice and Article 30 record. Document the US transfer with SCCs and DPF and the EU based processing. No cookie banner update is needed for the hosted checkout itself, but optional analytics on the same page must stay in the consent gated tag manager.

Compliance

Verifone 2Checkout and the GDPR

Legal basis
Contract performance (Art. 6(1)(b) GDPR) for processing payment data necessary to complete the transaction the customer has initiated. Legal obligation (Art. 6(1)(c)) for EU VAT collection and reporting, AML and tax record keeping, since 2Checkout is the merchant of record. Strictly necessary cookies on the hosted checkout are exempt from prior consent under Art. 5(3) ePrivacy.
Risk level
low
Applicable regulations
GDPR, UK GDPR, ePrivacy Directive 2002/58/EC, EU US Data Privacy Framework, EU VAT Directive (Council Directive 2006/112/EC), PSD2, AMLD5, PCI DSS Level 1, SOC 1 and SOC 2 Type II, US CCPA/CPRA

Impact assessment (DPIA)

A DPIA is not normally required for standard SaaS subscription billing through Verifone 2Checkout. It may become relevant when the integration is combined with extensive customer profiling, regulated industries or special category data tied to subscription tiers.

Sample text for your banner

Payments and invoicing on this site are handled by Verifone 2Checkout (Avangate S.A., Romania, part of Verifone Systems Inc., United States), our merchant of record. 2Checkout processes your payment data and EU VAT under contract and legal obligations, predominantly in EU data centres. International transfers to the United States are covered by Standard Contractual Clauses and the EU US Data Privacy Framework.
Cookies and trackers

What Verifone 2Checkout sets and contacts

Tracking method
Hosted payment and merchant of record (MoR) platform: Verifone 2Checkout hosted checkout served from secure.2checkout.com / secure.avangate.com; ConvertPlus inline form loaded from 2checkout.com sets first party Verifone session, CSRF and risk cookies on the checkout iframe; supports subscriptions, dunning, recurring billing and global tax compliance with multiple payment methods
Server location
United States and European Union (Verifone Systems Inc., headquartered in Coral Springs, Florida, with the 2Checkout product line operating largely from Bucharest, Romania, after the 2020 acquisition); production hosted on AWS and Verifone owned data centres in both regions; EU and UK customers are predominantly served from EU data centres in Romania, Ireland and Germany
Data transferred outside the EU
Verifone Systems Inc. is established in the United States. The 2Checkout product line is operated by Avangate S.A. in Bucharest, Romania, which is in the European Union. EU customer payment data is processed predominantly in EU data centres but some operational access from the United States is required. The 2Checkout / Verifone DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK International Data Transfer Addendum, and Verifone is self certified under the EU US Data Privacy Framework. As merchant of record, 2Checkout handles EU VAT collection.

Cookies set (4)

NameTypeDurationPurpose
twocheckout_sessionfirst_partySessionStrictly necessary session cookie on the Verifone 2Checkout hosted checkout used to maintain the customer cart and the in progress order.
twocheckout_csrffirst_partySessionCSRF protection token used to validate the payment form submission on the Verifone 2Checkout hosted checkout.
twocheckout_riskfirst_party30 minutesStrictly necessary fraud risk cookie used by Verifone 2Checkout for transaction risk scoring during the checkout.
twocheckout_localefirst_party1 yearFunctional cookie used by the Verifone 2Checkout hosted checkout to remember the customer's language and currency preference between sessions.

Third-party domains contacted (5)

  • 2checkout.com
  • secure.2checkout.com
  • secure.avangate.com
  • avangate.net
  • www.verifone.com
Questions

Frequently asked questions about Verifone 2Checkout

Can't find your question? Write to us, we answer fast.

What cookies does Verifone 2Checkout set?

On the hosted 2Checkout checkout (secure.2checkout.com / secure.avangate.com) only strictly necessary first party cookies are set: a session cookie keeping the cart (twocheckout_session), a CSRF protection token (twocheckout_csrf) and a fraud risk cookie (twocheckout_risk). Card data is tokenised in the PCI scope of Verifone and never reaches the seller.

Do I need consent to use Verifone 2Checkout?

No, the cookies on the hosted 2Checkout checkout are strictly necessary under Art. 5(3) ePrivacy and are exempt from prior consent. The customer's active decision to start a purchase is the legal basis under Art. 6(1)(b) GDPR.

What is the legal basis for processing payments through 2Checkout?

Contract performance (Art. 6(1)(b) GDPR) for processing payment data necessary to complete the transaction. Legal obligation (Art. 6(1)(c)) for EU VAT, AML and tax record keeping, since 2Checkout is the merchant of record. Strictly necessary cookies are exempt under Art. 5(3) ePrivacy.

Does Verifone 2Checkout transfer data to third countries?

Yes, with limited scope. EU and UK customer data is processed predominantly in EU data centres (Bucharest, Frankfurt, Dublin). Some operational access from the United States is required for Verifone operations and risk monitoring. Transfers are covered by the EU SCCs, the UK IDTA and the EU US Data Privacy Framework.

Do I need a DPIA for Verifone 2Checkout?

Standard SaaS billing through Verifone 2Checkout does not normally require a DPIA. It may become relevant when the integration is combined with extensive customer profiling, regulated industries or special category data tied to subscription tiers.

How do I implement Verifone 2Checkout compliantly?

Sign the Verifone 2Checkout DPA from your seller dashboard. Mention 2Checkout (Avangate S.A., Romania, part of Verifone, US) as merchant of record and processor in your privacy notice and Article 30 record. Document the US transfer with SCCs and DPF and the predominantly EU processing. Use the hosted checkout to keep card data out of your servers.

Are there alternatives to Verifone 2Checkout?

Other merchant of record platforms include Paddle (UK), Lemon Squeezy (US with DPF), FastSpring (US with DPF), Gumroad (US with DPF). Non MoR EU options include Stripe Billing (Ireland), Mollie (Netherlands), Adyen (Netherlands), Chargebee Billing and Recurly. EU based MoR offerings are still limited; Avangate / 2Checkout remains one of the few with a strong EU footprint.

How should I update my cookie and privacy policy for 2Checkout?

For most setups no banner update is needed because the hosted 2Checkout checkout sets only strictly necessary cookies under Art. 5(3) ePrivacy. Update your privacy notice to mention 2Checkout as merchant of record, the predominantly EU processing, the US transfer with SCCs and DPF and the customer's rights as data subject.

Same category

More services: E-commerce

See the whole category

UltraCart

UltraCart is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. UltraCart supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, UltraCart ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

ArtPlacer

ArtPlacer is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. ArtPlacer provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, ArtPlacer helps deliver the right message to the right audience at the right time.

Marketing

Reserva INK

Reserva INK is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Reserva INK supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Reserva INK ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

BON Loyalty

BON Loyalty is a customer loyalty and rewards platform designed to help businesses increase customer retention and lifetime value. It enables merchants to create customizable loyalty programs with points, tiers, referral bonuses, and exclusive rewards. BON Loyalty integrates with e-commerce platforms and POS systems, providing detailed analytics on customer engagement and program performance. BON Loyalty helps businesses build lasting customer relationships and drive sustainable revenue growth.

Preferences

Canvy

Canvy is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Canvy integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Canvy helps organizations maintain robust websites that meet user expectations and technical requirements.

E-commerce

Slotti

Slotti is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Slotti integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Slotti helps organizations maintain robust websites that meet user expectations and technical requirements.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site