CARDZ3N Gateway for WooCommerce

CARDZ3N Gateway for WooCommerce turns your WooCommerce store into a full-featured embedded checkout powered by the CARDZ3N / NMI payment platform.

Buyers stay on your site — no visible redirect — and can choose between credit/debit cards, ACH bank payments, Apple Pay, Google Pay, or a saved payment method inside a single gateway UI. js library, so card numbers and bank account numbers never touch your WordPress server.

B2B merchants benefit from automatic Level 2 and Level 3 commercial-card data — freight, tax, line-item, UPC, commodity code, PO number, and destination fields are populated from WooCommerce order data on every transaction.

Key features

• Embedded, on-site checkout — no redirect

• Credit / debit card, ACH / eCheck, Apple Pay, Google Pay — all in one gateway UI

• Saved payment methods (card + ACH) with NMI Customer Vault

• WooCommerce Subscriptions compatibility (if installed)

• WooCommerce Pre-Orders compatibility (if installed)

• Authorize-only + manual capture, void, full and partial refunds

• Auto-capture on order-status change

• 3-D Secure 2 / SCA

• Dynamic descriptor with optional per-order suffix

• Card-brand restrictions

• Automatic Level 2 / Level 3 data pass-through

• Optional checkout Purchase Order (PO) number field

• Merchant-visible diagnostics in WooCommerce → Status → Logs

Privacy

This plugin processes payment data on behalf of the store owner. Here is exactly what it stores and what leaves your server:

Stored on your WordPress site (per order):

• Card last 4 digits, brand, and expiry month/year — used to display saved methods and receipts.

• NMI Customer Vault ID — an opaque reference (not the actual card or account number) used to charge saved methods.

• NMI transaction ID, auth code, AVS/CVV response codes — used for refunds, reconciliation, and support.

• For ACH: bank name and last 4 digits of the account number (never the routing number or full account number).

Never stored on your WordPress site:

• Full Primary Account Number (PAN), full ACH account number, routing number, or CVV. These are tokenized by NMI Collect.js in the buyer’s browser before the form is submitted. Your server never receives them.

• Your NMI Security Key is stored only in WordPress options and is never sent to the browser.

What is sent to external services:

• To NMI Collect.js (browser-side): your public Tokenization Key, order total, buyer billing info as entered at checkout. Collect.js returns a one-time payment token.

• To the NMI Transaction API (server-side): your Security Key, the payment token or vault ID, order amount, buyer billing/shipping address, line items, and Level 2/3 commercial-card fields when enabled.

Controller / processor relationship: The store owner is the data controller. CARDZ3N / NMI acts as the payment processor. Buyers should be informed via the store’s own privacy policy that card and ACH data is transmitted to NMI for processing.

Data retention on your WordPress site follows your WooCommerce order retention settings. php that deletes its options automatically when deleted via Plugins → Delete.

External services

This plugin connects to two external CARDZ3N / NMI services to process payments:

• CARDZ3N Collect.js (https://z3n.transactiongateway.com/token/Collect.js) — JavaScript library loaded in the buyer’s browser at checkout from the CARDZ3N gateway host (a white-labeled NMI instance). It securely tokenizes card / ACH / wallet payment details into a one-time payment_token. No sensitive data is sent to your WordPress server.

com/terms/

com/privacy/

• CARDZ3N Transaction API (https://z3n.transactiongateway.com/api/transact.php) — server-side endpoint called by your WordPress site to execute charges, captures, voids, and refunds using the Collect.js token and your private Security Key. This is the white-labeled CARDZ3N gateway host; the plugin never calls secure.nmi.com.

com/terms/

com/privacy/

Your private Security Key is stored in WooCommerce gateway settings and is only used server-to-server. js.

License

0-or-later). html.

All PHP, JavaScript, CSS, and image assets bundled inside this plugin are first-party works authored by CARDZ3N and are released under the same GPLv2-or-later license. No third-party code or media libraries are redistributed inside the plugin package. js tokenization script is loaded at runtime from the payment processor’s own servers and is not included in this distribution.