What a payment gateway does
A payment gateway is the technology that sits between your customer and the bank, taking the card details someone enters on your website or app and sending them securely to be processed. It does not hold the money itself — it passes the transaction along to a payment processor, which talks to the card networks (Visa, Mastercard, American Express) and the customer's bank to confirm the funds exist and move them.
When a customer enters their card number on your checkout page, the gateway encrypts that information so it cannot be read in transit. It then checks whether the transaction looks legitimate — catching obvious fraud like a card being used in two countries in ten minutes — before sending it forward. If the bank approves the charge, the gateway tells your website the transaction went through. If it declines, the gateway tells your website that too, usually within seconds.
The gateway is also what keeps your business from ever seeing the raw card number. Instead of your servers storing "4532 1234 5678 9010", the gateway handles that part and gives your system a token — a stand-in reference number — so you can charge the same customer again without asking for their card a second time.
Key Takeaways
- A payment gateway encrypts card details, checks for fraud, and routes the transaction to the bank — it is the middleman between your checkout page and the financial system.
- You do not store card numbers yourself; the gateway does that and gives you a token instead, which reduces your security burden and your legal liability.
- Different gateways charge different fees, support different card types and countries, and integrate differently with your website or point-of-sale system.
- The gateway is separate from the payment processor; you may use one gateway with multiple processors, or one processor's gateway, depending on your contract.
- PCI compliance — the security standard for handling card data — is easier to meet when you use a hosted gateway that keeps card numbers off your own servers.
How the gateway fits into the payment chain
A complete card payment involves several companies, and the gateway is one piece. When a customer swipes or enters their card, the flow looks like this: your website or register sends the details to the gateway, the gateway sends them to the processor, the processor sends them to the card network (Visa or Mastercard), the network sends them to the customer's bank, the bank says yes or no, and that answer travels back through the same chain in reverse. The whole thing usually takes two to five seconds.
You contract with a payment processor (like Stripe, Square, or your bank's own processor). That processor may provide its own gateway, or you may choose a separate gateway company and tell the processor to accept transactions from it. Some businesses use multiple gateways — one for online orders, one for in-person card readers, one for phone orders — all feeding into the same processor.
The processor is who you pay fees to and who deposits the money into your business account. The gateway is the tool the processor uses to receive the transaction details. In many cases, especially for small businesses, the processor and gateway are the same company, so you do not think about them separately.
Hosted gateways versus integrated gateways
A hosted gateway redirects the customer away from your website to enter their card details on a page the gateway company controls. After they enter the card, they are sent back to your site with a confirmation. This approach means your servers never touch the card number at all, which makes PCI compliance much simpler — you do not have to prove your website meets the security standard for handling card data, because you are not handling it.
An integrated gateway (also called an embedded gateway) lets the customer enter their card details on your own checkout page, and your page sends those details directly to the gateway. This feels smoother to the customer — they never leave your site — but it means your website has to meet PCI compliance standards. You do not store the card number, but it passes through your servers, so you have to prove your infrastructure is find.
Most modern gateways use a hybrid approach: your page collects the card details using code the gateway provides, that code encrypts the card number before it ever leaves the customer's browser, and your server never sees the raw number. This gives you the smooth checkout experience of an integrated gateway with the compliance simplicity of a hosted one. Stripe, Square, and Shopify all work this way.
Fees and what they cover
Payment gateways charge in several ways. The most common is a per-transaction fee — usually between 2.2% and 3.5% of the transaction amount, plus a flat fee of 20 to 30 cents per transaction. Some gateways charge a monthly subscription instead of, or in addition to, per-transaction fees. A few charge a percentage only, with no flat fee.
What you get for that fee varies. All gateways provide encryption, fraud detection, and the basic routing of the transaction. Some include a virtual terminal (a web page where you can manually enter a card number to charge it), some include a mobile app, some include recurring billing tools, and some charge extra for those features. International gateways may charge more if you accept cards from outside your home country.
The fee does not include what the card networks and banks charge — those are separate and usually bundled into the processor's fee. Your processor might charge you 2.9% + 30 cents, and that single fee covers both the gateway and the network costs. When comparing gateways, ask what is included in the quoted fee and what is billed separately.
Security and PCI compliance
PCI DSS (Payment Card Industry Data Security Standard) is the rulebook for how any business that touches card data must protect it. If you use a hosted or hybrid gateway, you do not store card numbers, so your compliance burden is light — you mainly have to keep your website software updated and use HTTPS (the padlock in the browser address bar). If you use a fully integrated gateway, you have to prove your servers meet a longer list of security requirements.
The gateway itself is responsible for PCI compliance on its own side — it has to prove to the card networks that it encrypts data, logs access, and audits its systems. When you choose a gateway, check whether it is PCI Level 1 certified, which is the highest standard. Most major gateways are.
You are also responsible for not storing card numbers yourself, even by accident. Do not save a card number in an email, a spreadsheet, or a database. If you need to charge a customer again, use the token the gateway gave you the first time. The gateway handles the card number; you handle the token.
Choosing a gateway for your business type
If you run an e-commerce website, you need a gateway that integrates with your shopping cart software (Shopify, WooCommerce, BigCommerce, etc.). Most major gateways have plugins for these platforms, so the integration is a few clicks. If you use custom code, you need a gateway with good API documentation and developer support.
If you run a brick-and-mortar store, you need a gateway that works with point-of-sale systems — either a system the gateway provides itself (like Square or Toast) or one that connects to your existing register. Some gateways are online-only and do not support in-person card readers.
If you take payments over the phone or by mail, you need a virtual terminal — a web page where you manually enter the card details. Most gateways include this, but confirm it before you sign up. If you bill customers on a recurring schedule (subscriptions, memberships), you need a gateway with recurring billing or subscription tools built in.
If you sell internationally, check whether the gateway supports the countries and currencies you need. Some gateways are US-only; others support dozens of countries but charge higher fees for cross-border transactions.
Common gateway providers and what they offer
Stripe is a developer-friendly gateway used by many e-commerce sites and SaaS companies. It charges 2.9% + 30 cents per transaction for US cards and supports most countries. It has strong API documentation and works with almost any shopping cart or custom website.
Square is known for point-of-sale systems and in-person payments but also offers online checkout. It charges 2.9% + 30 cents for online transactions and 2.6% + 10 cents for in-person card readers. It is straightforward to set up and good for small retail businesses.
PayPal offers a gateway (PayPal Commerce Platform) alongside its traditional PayPal Checkout button. Fees are 2.99% + 30 cents for online transactions. It is widely recognized by customers but has a reputation for slower payouts and stricter account monitoring.
Authorize.Net is one of the oldest gateways and is used by many traditional businesses and banks. It charges a monthly gateway fee (around $25) plus per-transaction fees. It is less trendy than Stripe but very reliable and widely supported by legacy systems.
2Checkout (Verifone) supports many countries and currencies and is popular for digital products and SaaS. Fees vary by region but typically run 3.5% to 5% for international transactions.
Frequently Asked Questions
Do I need a separate gateway if my processor provides one?
No. If your processor (like Stripe or Square) provides a gateway, you use theirs. You only need a separate gateway if you want to use a processor that does not provide one, or if you want to use multiple processors and route transactions between them. For most small businesses, the processor's gateway is all you need.
What happens if a transaction is declined?
The gateway receives the decline message from the bank and passes it back to your website or register. Your checkout page should show the customer a message like "Card declined — please try another card." The customer can then enter a different card or contact their bank. The declined transaction does not charge them and does not cost you a fee.
Can I use the same gateway for online and in-person payments?
Some gateways support both, but not all. Stripe and PayPal support online checkout but require a separate card reader for in-person payments. Square supports both from the start. Authorize.Net supports both but requires separate setup. Check the gateway's documentation before you sign up if you need both.
What is tokenization and why does it matter?
Tokenization is when the gateway replaces the card number with a unique code (a token) that only the gateway can decode. You store the token, not the card number. When you need to charge the customer again, you send the token to the gateway, and the gateway uses it to retrieve the card number and process the charge. This means you never handle the card number yourself, which reduces your security risk and compliance burden.
Do I have to use the gateway my bank recommends?
No. Your bank may offer a gateway, but you can use any PCI-certified gateway and route the transactions to your bank's processor, or to a third-party processor entirely. You are not locked in. That said, using your bank's gateway may simplify reconciliation because deposits and transactions appear in the same place.