A payment gateway is the technology that captures a customer’s card or bank details at checkout, encrypts that data, and facilitates the authorization request between your checkout, the payment processor, and the customer’s bank.

It is the security layer standing between your checkout page and the rest of the payment processing gateway chain, though many modern providers bundle the gateway with processing and even the merchant account under one contract.

Choose a provider that maintains current PCI DSS compliance, and confirm what your own remaining compliance obligations look like once you’re using it.

This guide breaks down exactly how a payment gateway works, how it differs from a payment processor, the types available, and how to choose the right one for your industry, including high-risk categories like collections, healthcare, and auto finance that standard providers often decline.

Quick Facts

• A payment gateway securely captures and transmits payment data and facilitates the authorization request; it is one piece of the broader payment processing chain, and many payment service providers bundle it with other roles.
• Some businesses use a separate gateway, processor, acquirer, and merchant account; others use an all-in-one provider like Square or PayPal that bundles most of those roles into a single sign-up.
• PCI DSS v4.0.1’s(opens in new tab) future-dated requirements became effective March 31, 2025, per the PCI Security Standards Council. Using a PCI-compliant gateway reduces your exposure but does not eliminate your own PCI DSS obligations as a merchant.
• Hosted gateways redirect customers to a third-party page and narrow, but don’t eliminate, your PCI DSS scope; integrated gateways keep checkout on your own domain through an API and generally carry more of that scope.
• High-risk industries such as debt collection, CBD, travel, and auto finance commonly need a specialized gateway, since generalist providers frequently cap volume or terminate accounts with little notice, though requirements vary by individual business and processing history.
• Settlement timing, fee structures, and support terms vary by provider, payment method, and account history; treat figures like “one to three business days” as common examples, not guarantees.

What Is a Payment Gateway, Exactly?

A payment gateway is best understood as a digital bridge between your online point of sale and the financial institutions that move money. Rather than a physical card swipe, a credit card payment gateway captures the card or bank data your customer types into a checkout form, encrypts it immediately, and confirms with the issuing bank that the funds exist and the transaction is legitimate.

The payment gateway definition that matters most for your business is functional, not technical: it is the piece of infrastructure that captures, encrypts, and requests authorization for every transaction, then relays the issuing bank’s decision back to your checkout. Without one, there is no way to verify a card number, screen for stolen credentials, or protect the transaction data in transit.

That is what a payment gateway does at its core: it facilitates authorization and secures the data in transit, while the actual approve-or-decline decision comes from the customer’s card issuer.

How Does a Payment Gateway Work?

Every transaction moves through a fast, largely invisible sequence. Understanding how a payment gateway works helps you spot exactly where a checkout is failing if customers start reporting declined or stuck payments.

1. Encryption. Your customer enters their card or bank details at checkout, and the gateway encrypts that data before it leaves the browser.
2. Request. The encrypted payment request is forwarded to your payment processor, which acts as the go-between connecting your business to the wider card networks.
3. Network and fraud screening. The request typically continues through the acquirer and a card network, such as Visa or Mastercard, which may apply fraud screening before passing it to the issuing bank. Fraud checks can happen at more than one point in this chain, not only here.
4. Authentication (when triggered). Depending on the issuer, card network, merchant settings, or regional rules, some transactions trigger 3D Secure authentication, an added identity check that the customer completes on their own device. It isn’t automatic for every higher-risk transaction; each of those parties applies its own risk criteria.
5. Authorization. The issuing bank checks for available funds and account status, then returns an approval or decline code. This exchange is typically near-instant, though issuer systems, fraud reviews, or a 3D Secure challenge can add time.
6. Relay and settlement. The gateway relays the outcome to the merchant and customer, and approved funds move toward settlement, coordinated by the processor, acquirer, and card networks together. Funds typically reach your merchant account within 1 to 3 business days, though timing varies by provider, payment method, and account history.

This is the payment gateway functionality every provider builds around, though bundled providers like Stripe, PayPal, and Square combine several of these steps under one contract rather than routing through fully separate companies. The variation between providers comes down to how well each step is secured, how quickly authorization returns, and what happens when something in the chain fails.

What’s the Difference Between a Payment Gateway and a Payment Processor?

These two terms get used interchangeably, and that blurs an important line when you’re comparing providers. In the traditional model, a payment processing gateway captures, encrypts, and requests authorization for the transaction, while a separate payment processor coordinates the movement and settlement of funds between the issuing bank, card networks, and your merchant account.

In practice, many modern payment service providers, including Stripe, PayPal, and Square, bundle both roles (and sometimes the merchant account itself) into a single product, so the lines are not always as clean as the traditional model suggests.

	Payment Gateway	Payment Processor
Primary role	Captures and encrypts payment data, requests authorization	Coordinates fund movement and settlement with the acquirer and card networks
Where it sits	Between your checkout and the processor	Between the gateway, the acquirer, and the card networks
Security focus	Encryption, tokenization, fraud screening	PCI DSS compliance, network-level fraud controls
Merchant account	Typically does not provide one	Often provides or requires one
Customer-facing	Yes, at checkout	No, works entirely in the background

 

Bundled providers like Stripe and Square offer both functions under one contract, which can be convenient for small, low-risk businesses.

Whether a single bundled provider or separate, specialized gateway and processor partners serve you better is worth evaluating case by case: compare underwriting flexibility, reserve terms, support responsiveness, and termination clauses rather than assuming bundled or split is automatically the better setup.

👉 For a deeper breakdown of where the responsibilities split, see our dedicated guide on payment processor vs payment gateway(opens in new tab).

What Types of Payment Gateways Are There?

There are three primary types of payment gateway you are likely to encounter when setting up an online checkout, and the right one depends on how much control and development capacity your business has.

Hosted (Redirect) Gateways

With a hosted gateway, your customer is redirected to a secure, third-party payment page, such as a standard PayPal checkout, to finish the transaction before returning to your site.

Setup is fast, and routing card entry through a hosted page narrows how much cardholder data touches your own servers, which reduces, but does not eliminate, your PCI DSS scope; you’re still responsible for maintaining a secure website and completing your own validation. You also lose some branding control and add a step to checkout that can affect completion rates.

Integrated (API) Gateways

Integrated gateways keep the customer on your own website throughout the entire checkout, connecting to the processor through an API in the background.

This preserves your branding and gives you more control over the checkout experience, which can help reduce friction when it’s implemented well, though conversion also depends on site performance, trust signals, and available payment methods. It puts more PCI DSS responsibility on your business and requires development resources to maintain.

On-Site (Self-Hosted) Gateways

Running payment infrastructure entirely on your own servers is technically possible, but uncommon. It demands significant security certification, ongoing compliance work, and dedicated operational resources, which is why most large-volume merchants still rely on external gateways or processors with deep, custom integrations rather than fully self-hosting.

Type	Setup Speed	Branding Control	PCI DSS Scope	Best For
Hosted	Fastest	Low	Reduced, not eliminated	Small businesses, fast launches
Integrated	Moderate	High	Moderate to high	Growing e-commerce and subscription businesses
On-site (self-hosted)	Slowest	Full	Highest	Rare; enterprises with dedicated security and compliance teams

 

Choosing between hosted vs integrated payment gateway setups is really a question of how much checkout friction you can tolerate versus how much compliance workload you can take on internally.

What Are the Benefits of a Payment Gateway?

The benefits of payment gateway technology go well beyond simply letting you accept a card number online.

• Fraud protection. Tools such as Address Verification Service (AVS), CVV checks, and 3D Secure authentication are designed to catch fraudulent attempts before they become chargebacks, though how well they perform depends on the market, issuer support, and how strictly a provider configures them.
• Real-time authorization. Approvals and declines typically return in seconds, so customers get fast feedback instead of waiting on manual review, though issuer or fraud-review delays can occur.
• Tokenization. Card data is replaced with a token that substitutes for the sensitive card number. Depending on the provider and transaction type, that token may be single-use or reusable for card-on-file and recurring billing, but either way it keeps the original card number off your servers and helps reduce your PCI DSS scope.
• Reporting and reconciliation. Dashboards can let your finance team track payment trends, success rates, and disputes without manually cross-referencing bank statements, provided the reporting features you need are included in your plan.
• Omnichannel support. Many gateways can process card-on-file, phone, text, and recurring payments alongside standard checkout, though which specific channels are supported varies by provider, so confirm the exact list against what your business needs.

If chargebacks or account takeovers are already an active problem for your business, our guide to payment gateway fraud prevention(opens in new tab) walks through the specific detection tools worth asking a provider about.

How Do You Choose the Best Payment Gateway for Your Business?

There is no single best payment gateway, only the right fit for your risk profile, volume, and customer base. Here is how to approach how to choose a payment gateway based on where your business sits.

If You’re a High-Risk Merchant

Debt collection agencies, CBD retailers, travel companies, and auto finance operations should prioritize a merchant payment gateway built for their high-risk category(opens in new tab) rather than a generalist platform that may terminate the account mid-contract.

Look for rolling reserve terms you can actually live with, a verifiable uptime track record (ask for real performance history, not just a promised percentage), and industry-specific fraud filters rather than one-size-fits-all rules.

If You’re a B2B or CFO-Led Team

For B2B teams, transparent interchange-plus pricing matters more than a flashy low headline rate, because hidden fees show up in reconciliation later.

Prioritize a payment gateway for business use that supports ACH alongside cards; our ACH payment solutions(opens in new tab) integrate with the same reporting your team already relies on for reconciliation. Robust, exportable reporting that plugs into your accounting software should be a requirement, not a nice-to-have.

Universal Must-Haves

Regardless of industry, do not sign with any provider that cannot demonstrate current PCI DSS v4.0.1 compliance and explain clearly what compliance obligations remain yours once you’re using their platform.

Also prioritize 24/7 support and tokenization for recurring billing. Multi-currency support matters even for domestic-only businesses today, since international customers increasingly expect to see pricing in their own currency before they complete a purchase.

Payment Gateway Comparison: How the Leading Providers Stack Up

Every payment gateway comparison starts with the same three questions: what does it cost, what does it support, and who is it actually built for.

The figures below are U.S. advertised rates as published by each provider. They typically exclude international cards, currency conversion, custom or negotiated pricing, and alternative payment methods, so confirm current terms directly with any provider before signing.

Provider	Typical U.S. Transaction Fee	Monthly/Setup Fee	Best Fit
Payment Savvy	Interchange-plus, quoted per business	Per Payment Savvy’s stated pricing terms	Regulated and high-risk industries
Stripe	~2.9% + $0.30 (standard domestic card rate)	None advertised	Developer-led e-commerce
PayPal	~2.89% + $0.29 (domestic card processing)	None advertised	General small business
Square	~2.9%-3.3% + $0.30 online, varies by plan	Varies by plan	In-person plus online hybrid

 

Cheapest payment gateway and best online payment gateway searches almost always miss the fees that do not show up on the pricing page: monthly minimums, PCI non-compliance fees, batch fees, currency conversion, and early termination penalties.

Ask any provider, including us, for a complete written fee schedule before comparing headline rates. Payment Savvy states that its pricing is fully disclosed before you sign, and our team can walk through exactly how a quote compares to what you’re currently paying.

Our own online payment gateway service(opens in new tab) is built for the compliance and volume needs that generalist providers are often not underwritten to support.

Ready to see what a transparent quote looks like for your business? Talk to the Savvy Squad(opens in new tab) and ask for pricing, current uptime data, and support terms in writing, including details on next-day funding and 24/7 US-based support.

Frequently Asked Questions

What does a payment gateway do?

A payment gateway captures a customer’s payment details at checkout, encrypts that data, and sends it to the payment processor and issuing bank for approval. It returns an authorization or decline within seconds and keeps the transaction data secure throughout. It does not move or hold funds; that step belongs to the processor and the merchant’s bank.

Do I need both a merchant account and a payment gateway?

In most traditional setups, yes. The payment gateway facilitates authorization and secures the transaction data, while the merchant account is where the approved funds are actually deposited. Some all-in-one providers, like Square or PayPal, bundle both under a single sign-up instead of requiring a separately visible merchant account, so confirm which model a given provider uses before assuming you need to set up your own.

What is the cheapest payment gateway for a small business?

There is no universal cheapest option, since fees depend on your transaction volume, industry risk category, and pricing model. Flat-rate providers advertise low headline rates but often add monthly, PCI compliance, or batch fees. Interchange-plus pricing with full fee disclosure, rather than the lowest advertised rate, typically saves more over a full year.

Is a payment gateway the same as a payment processor?

No. A payment gateway captures and encrypts payment data and requests authorization, while a payment processor moves the funds and settles the transaction between the issuing bank and your merchant account. Many providers bundle both roles, which is why the terms get used interchangeably even though the functions are distinct.

What is the difference between a hosted and an integrated payment gateway?

A hosted gateway redirects customers to a third-party page to complete payment, which is faster to set up and narrows your PCI DSS scope, but adds a step to checkout. An integrated gateway keeps customers on your own site through an API connection, preserving your branding and giving you more control over checkout, which can help reduce friction when it’s implemented well, at the cost of more development work and PCI DSS responsibility.

Which payment gateway works best for high-risk businesses?

High-risk businesses, including debt collection, CBD, travel, and auto finance, generally do better with a gateway built for their category rather than a generalist platform. Look for workable rolling reserve terms, a verifiable uptime history, and industry-specific fraud filters. Payment Savvy states that it specializes in these categories; ask any provider directly about its underwriting track record in your specific industry before signing.

Building a Savvy Foundation

The right payment gateway is more than a checkout utility, it is a security and customer experience engine that either protects your revenue or quietly leaks it through chargebacks and abandoned carts. If your current setup cannot clearly explain its PCI DSS compliance, its full fee structure, or how it handles your specific industry’s risk profile, it is worth a second look.

Get a free quote from Payment Savvy(opens in new tab), and our team can walk you through a gateway solution built around your industry’s compliance and volume needs. Ask about our stated terms on 24/7 US-based support and next-day funding, and get everything in writing before you sign.