Card data

Layout never has your card number. Not in a database column, not in a log line, not in a debugging trace, and not in anything a model reads. This page is where it does live and what we hold instead.

Where the number goes

When you save a card, the fields you type are captured by our payment provider's own components in your browser or app and sent straight into their PCI compliant vault. Our servers are not in that path.

What comes back to us is a token: an identifier for a card we cannot read. It is what we use to say "pay with the card the user saved," and it is worthless anywhere else.

The vault belongs to a payment provider whose category is listed with everything else on layout.link/subprocessors. Keeping card data inside their vault is what keeps our own compliance scope narrow by design, rather than by promising to be careful with something we hold.

What the restaurant sees

Not your card. Layout pays the restaurant with a Layout virtual card, so your number is never typed into a merchant's checkout and no restaurant ever holds it.

The card a restaurant charges carries a small allowance over the total you approved, because their own tax line is added by their checkout and a card authorized for exactly the cart total would decline at the last step. Your own hold is not padded to match: it is the total you confirmed and nothing more. Details are in money controls.

What never reaches a log

This is a rule in the codebase rather than a habit: card numbers, security codes and expiry dates never reach a log, a trace, a model prompt, or our database. What we do record about a card is shape: a brand, the last four digits, whether it verified.

New logging on the payment path goes through a masking sink rather than a plain print statement, so the default outcome of somebody adding a debug line in a hurry is a masked value rather than a leak.

The card Layout pays with is held to the same rule. Its number is fetched by the part of Layout that fills in the restaurant's checkout, used there, and never written down. Only the last four digits appear in any record of the order.

When your bank wants a word

Sometimes a card needs verifying with your bank before it can pay. When that happens, Layout says so plainly and gives you one thing to do, on our own page, with your bank's own flow inside it. We do not ask you to retype a card number to fix it, and we never ask for a card number over email, chat or the phone.

If anything claiming to be Layout asks you for a full card number, it is not us.

Refunds

How a refund is issued, what qualifies for one, and how long you have to ask are policy, so they are published in one place and it is not this one: how refunds work.

Deleting a card

Remove it in your account and the token goes with it. There is no copy elsewhere, because there was never a number for us to copy.