Technical FAQ

Common questions from prospective and newly onboarded sub-merchants and platform partners — how ClientLoop is structured, how money moves, what we are certified for, and what an integration looks like.

If you cannot find an answer here, contact your account manager or sales representative.

---

About ClientLoop

Is ClientLoop a gateway, a processor, or a reseller?

None of those. ClientLoop is a commercial payment facilitator (PayFac) — we are not an ISO or a reseller. The platform is our own technology, integrated directly with our partnering banks and with direct contracts with partners such as Plaid (ACH) and FlexPay (consumer finance). There is no third-party gateway or processor sitting in the middle of a transaction.

Because we are the payment facilitator, the risk of onboarding a sub-merchant is ours to assume: if a sub-merchant we onboard cannot cover its chargebacks and reversals, we cover them. That is why our underwriting is deliberate and why we run thorough, continuous KYC monitoring on onboarded sub-merchants rather than checking identity once at signup.

What payment methods can my customers use?

• Credit and debit cards — Visa, Mastercard, American Express, and Discover.
• Bank payments (ACH) — with account linking through Plaid.
• Consumer finance — installment and financing offers through FlexPay.

Transactions are processed in USD, and sub-merchants are onboarded in the United States. If you need another currency or geography, raise it with your account manager before you design the integration.

Which methods a customer sees at checkout depends on what is enabled for your account — the Checkout component renders exactly the configured set.

What is ClientLoop's SLA?

We commit to 99.9% uptime on payment processing. We do not currently publish a public status page or outage history.

How will I hear about an outage or planned maintenance?

By email, sent to the contacts on your account. Make sure the address we have on file reaches someone who is on call, not a shared inbox nobody watches.

How does ClientLoop handle high availability and redundancy?

We are hosted exclusively in AWS, and the platform runs in a multi-master configuration across multiple AWS regions. Latency-based DNS routing sends each transaction to the active region closest to the caller, so a regional failure removes capacity rather than availability.

The architecture is event-driven, and there are no relational databases in the primary transaction path. We build on serverless AWS services, which lets the platform scale linearly and quickly enough to absorb large sales events and traffic spikes without pre-provisioning.

---

Onboarding and testing

How long does approval take?

Most merchants are approved in under 10 minutes. An account flagged for additional review takes longer, since a person reviews it.

Approval is not the same as being live: how quickly you start processing after that depends on your integration requirements — see development timelines.

Is there a test environment?

Yes — a staging environment that mirrors production, so you can build and test without moving real money.

Stage accounts are not self-serve. Contact your account manager or sales representative and describe your direct integration use case, and we will provision one for you.

Once you have stage credentials:

• point the client at https://graph.stage.clientloop.com;
• set env="stage" on the embedded components (see Checkout);
• use the Stage entry in the environment switcher on the API Reference page to explore the schema against staging.

Ask your integration contact for test card numbers and test bank credentials to use in stage.

Can I bring my existing stored payment methods from another processor?

We support this on a case-by-case basis — migrating a vault involves a PCI-compliant transfer between providers, so it is not a self-serve operation. Talk to your sales associate or account manager early if you are switching from another processor, since it affects your cutover plan.

---

Security and compliance

How secure is ClientLoop?

• PCI DSS Level 1 — the highest and most rigorous tier of compliance in the Payment Card Industry Data Security Standard.
• SOC 2 Type II — held by our parent company.
• CCPA and GDPR — we adhere to both frameworks.
• 24x7x365 monitoring — continuous monitoring through a network and security operations center.

Do I need to touch or store PCI data to use ClientLoop?

No — and we deliberately make it impossible to do so casually. We do not expose public APIs that let you transact directly with raw card or bank data. That protects you as much as it protects us: card data never enters your systems, so it never enters your PCI scope.

Payment details are collected either through our hosted payment forms or through our native web components, which send the sensitive fields straight to ClientLoop. Your integration works with sessions and tokens — see the Checkout and Apply guides.

We can export stored payment methods where a use case genuinely warrants it — for example, if you are leaving the platform — provided you supply a valid PCI attestation.

Which PCI SAQ do I qualify for?

Most ClientLoop merchants qualify for SAQ A, the shortest self-assessment questionnaire, because card data is captured by ClientLoop rather than by your systems. If you redirect customers to our hosted payment form, SAQ A is the normal outcome.

If you embed our web components in your own pages, your acquirer or QSA may place you in SAQ A-EP instead, since your page — though it never touches card data — is what delivers the payment form. The deciding factor is your assessor's reading of your specific implementation.

Confirm your SAQ level with your acquirer or QSA before relying on it. We can supply our own attestation of compliance to support your assessment.

Do you support 3-D Secure and SCA?

Yes. 3-D Secure is supported, and where a card or issuer requires a challenge it is presented inside our hosted forms and components. Your integration does not need to implement the authentication flow or handle the challenge result — you continue to work with sessions, exactly as you would without it.

How should I handle API keys?

API keys authenticate server-to-server calls as a Bearer token (see the Introduction). Treat them as production secrets:

• Server-side only. Never ship a key in browser JavaScript, in a mobile app bundle, or in a public repository. Browser flows do not need one — your server creates a short-lived session and the component consumes that instead.
• Store them in a secret manager, not in source control or in a committed .env file.
• Use separate keys per environment, so a stage key can never move production money.
• Rotate them when someone with access leaves or a key may have been exposed — contact your account manager. Webhook signing secrets rotate independently through the API; see Signatures.

Where is my data stored?

In AWS, across multiple regions (see high availability). Data belonging to EU customers is kept in EU regions, which is part of how we meet our GDPR obligations. If you have a specific residency requirement, raise it with your account manager before you go live.

---

Money movement

How quickly are transactions settled?

As a new sub-merchant, expect funds 3–5 days after the transaction, depending on the hold time associated with your account and the payment method the consumer used. ACH is generally slower than credit cards and is more affected by banking holidays and weekends.

As you build a track record of low chargebacks, reversals, and refunds, we may shorten your hold so you receive funds faster. Voluntary reserves are another way to shorten it (see reserves).

For time-critical transactions we support same-day ACH and real-time payments, at higher cost. Talk to your account manager or sales associate if these are relevant to your business.

Does ClientLoop settle net or gross?

Net. Fees are taken out in real time, as part of the transaction, before it settles — you are not invoiced separately after the fact.

What does a refund cost?

Refunds are not free. The processing fees taken on the original transaction are not returned to you when you refund it, and the refund itself carries a cost.

Budget for both: a sale that is later refunded leaves you down the fees on the original transaction and the cost of reversing it, not just the sale amount. If refunds are a routine part of your business model rather than an exception, raise it with your account manager so it can be reflected in your rates.

How do I reconcile a payout against my transactions?

Because settlement is net, the amount that lands in your bank account is not the sum of your transaction amounts. The original payment amount is always available alongside the settled figure — in the back-office portal, through the API, and in the webhook payload for the payment — so you can tie each deposit back to the transactions that produced it.

We are also releasing automated reconciliation for QuickBooks, Xero, and NetSuite, which removes the manual step entirely. Ask your account manager about timing if you need it.

Does ClientLoop implement reserves?

ClientLoop reserves the right to impose reserves based on risk factors. In general, new sub-merchants are not subject to reserves outside of special cases.

Reserves also work in your favor: voluntarily holding a reserve lets us reduce your hold time and improve your settlement timing.

How are chargebacks and disputes handled?

For your first few chargebacks and disputes, we work them directly with you. That gives us a read on your risk profile and on your ability to manage disputes yourself.

After that initial period, you are granted access to the chargeback and dispute tools in our back-office portal and handle them yourself, with our support.

How does ClientLoop monitor for fraud?

Every transaction gets a fraud rating, calculated differently depending on the payment method. The scores come from machine-learning models and rulesets managed exclusively by ClientLoop and its acquiring banks, and they are tuned over time against the data and patterns we see for each individual sub-merchant.

The process is intentionally opaque to sub-merchants. If you want to consume fraud risk ratings in your own systems, we can expose the relevant fields in the GraphQL API on request.

Can I pass processing costs on to my customers?

You can, but in most cases you should not. Credit card surcharging is capped by the card networks, restricted or banned outright in several states, and carries per-violation penalties — and the rules change frequently.

Read Credit Card Surcharging before you consider it. Our recommendation there is blunt: for most merchants, a cash-discount or dual-pricing program, or simply pricing the cost in, is the safer way to recover processing costs.

---

Marketplace and split settlement

I run a services platform — how do I get paid from the sub-merchants I onboard?

ClientLoop supports split configuration payments. During settlement we apportion the original transaction amount (after fees) and route the pieces to balance accounts for multiple parties, so your platform's cut and the sub-merchant's proceeds settle out of the same consumer payment.

One requirement to plan for: every participant in a split settlement must go through underwriting and be onboarded as a sub-merchant. This is not a platform limitation — it is required by the anti-money-laundering regulations we operate under.

---

Integration and support

Can I take recurring or installment payments?

Yes. Payment plans charge a contact's stored payment method on a schedule — weekly, monthly, quarterly, or yearly. A plan can also be created with no frequency at all, in which case nothing is charged until you explicitly run it through the API, which suits usage-based or invoice-driven billing.

Plans are created through a payment plan session, the same session-based pattern the Checkout component uses for one-time payments. See the API Reference for the payment plan operations.

How do I find out when something happens?

Subscribe to webhooks rather than polling. ClientLoop sends an HTTP request to a URL you control when a subscribed event occurs — for example, when an application's status changes or a payment completes.

• Webhooks overview — delivery, retries, and payload format. Failed deliveries retry with backoff for up to 7 days, and every delivery is recorded and retained for 90 days.
• Signatures — verify a delivery genuinely came from ClientLoop before trusting it.
• Events — the catalog of events you can subscribe to.

How does ClientLoop protect against duplicate transactions?

Idempotency is built into our native web components. If you use them to take one-time payments or to charge a payment method on file, duplicate submissions are handled for you — no work on your side.

When you charge a contact's stored payment method directly through the API, pass an idempotency key with the request. If the same key arrives again — after a network failure, a timeout, or a client-side retry — we return the result of the original charge rather than creating a second one.

Where is ClientLoop's integration documentation?

• Technical documentation — https://docs.clientloop.com (this site).
• CRM and general product documentation — https://clientloop.com/kb.

We are still migrating content from our previous documentation site, so if you cannot find something here, contact your account manager or sales representative rather than assuming it does not exist.

How do I escalate an emergency?

Enterprise sub-merchants integrating directly against our API are given a 24x7x365 hotline. Our infrastructure and development teams span the Americas, Europe, Asia, and Africa, so we operate a follow-the-sun model and there is always an engineer awake.

The hotline is for technical emergencies only — outages and urgent integration failures. It routes you to an engineer, not to a call center agent, and abuse of it for general support is not tolerated.

Everything else should go through your account manager, or through the Slack Connect channel if one has been set up for your integration and support model.

Can ClientLoop provide hands-on development help with our integration?

Yes — this is something we excel at. If your use case fits our processing model, your stack matches our skill set, and the volume justifies it, we will generally provide this effort at no charge.

For larger projects that go beyond payment integration, we have development and cloud infrastructure partners we can refer you to or sub-contract.

Availability varies with ongoing integrations and demand. As a rough planning guide:

Phase	Typical duration
Kickoff	2–6 weeks from engagement
Integration	30–90 days, depending on complexity, technologies, and testing requirements

Consumer finance integrations often need extra effort to satisfy consumer finance law, depending on the integration pattern required.