Integration Overview
To correctly process transactions, the first step is choosing the integration method that best fits your needs.
Fabrick Payment Orchestra provides several integration types designed to ensure flexibility and adapt to different contexts, from standard hosted payment pages to more advanced API-based integrations.
Integration Types
The Fabrick Payment Orchestra gateway offers different integration methods:
Hosted Payment Page Orchestra (HPPO)
This solution provides the standard Fabrick payment page, customizable with the merchant's logo and configurable payment methods (e.g., Cards, PayPal, etc.).
The integration mode is defined as full redirect: the buyer is redirected to the Fabrick payment page, where they can select one of the payment methods enabled by the merchant.
The required questionnaire for this integration is SAQ A.
Pay By Link
This integration allows you to present the Fabrick payment page in full redirect mode, with the possibility to configure the validity period and expiration date of the payment request.
The solution provides several channels to propose payment to the customer:
- Payment link generation via direct request to Fabrick
- Sending the link via email through Fabrick services
- QR code creation to allow customers to complete payment via scanning
Thanks to its versatility, the Pay By Link solution can support cross-selling and up-selling strategies, helping increase conversion rates and customer retention.
The required questionnaire for this integration is SAQ A.
Lightbox
Integration method that allows the Fabrick payment page to be displayed as a pop-up directly on the merchant's website using a JavaScript module, ensuring a smooth and integrated user experience.
The required questionnaire for this integration is SAQ A.
Web Component
Integration based on dynamic components that allow managing the payment experience directly within the ecommerce environment.
The required questionnaire for this integration is SAQ A.
API Only
Ideal solution for merchants who need to integrate gateway services in more structured environments, for example to connect payment platforms with management systems.
This mode also allows creating a custom payment page, consistent with the brand's design and user experience.
API Only (Client)
In integrations involving a custom payment page, where card data is entered via browser, mobile app, or webview and sent directly to Fabrick (for example via front-end submission without passing through merchant servers), the required questionnaire for this integration is SAQ A-EP.
API Only (Server)
In server-side integrations, where card data passes through the merchant's back-end systems before being sent to Fabrick, the required questionnaire is SAQ D. Depending on transaction volumes, additional documents such as AOC and ROC may also be required.
Plugin
Fabrick provides installable plugins for major CMS platforms, simplifying the connection between ecommerce systems and the gateway. Visit the dedicated plugin page for further details.
The required SAQ model depends on the plugin, generally SAQ A or SAQ A-EP.
PCI DSS Requirements: SAQ, AOC and ROC
To understand the responsibilities associated with each integration method, it is essential to know the PCI DSS compliance requirements, the international standard governing the handling, transmission, and storage of payment card data.
SAQ - Self-Assessment Questionnaire
The SAQ is an official questionnaire through which the merchant self-certifies compliance with PCI DSS standards. The chosen integration method determines the applicable SAQ model.
-
SAQ A
The merchant does not handle or transmit card data on their own systems. This category includes solutions using full redirect and all integration modes where card data is entered on the Fabrick payment page. -
SAQ A-EP
The merchant does not store card data, but their front-end manages the direct submission of data to Fabrick. Requires higher security levels compared to SAQ A. -
SAQ D
Card data passes through or is processed on the merchant's server. This model involves the highest level of technical, organizational, and security requirements.
AOC - Attestation of Compliance
The AOC is an official document certifying PCI DSS compliance of a merchant or service provider. It may be issued by a Qualified Security Assessor (QSA) or through an approved internal audit.
ROC - Report on Compliance
The ROC is a detailed report documenting PCI DSS compliance verification. It is required when the merchant falls under the SAQ D scenario or manages high transaction volumes.
Integration Summary Table
| Integration | Interaction Type | Card Data Entry | Card Data on Merchant Server | SAQ |
|---|---|---|---|---|
| HPPO | Full redirect | Fabrick page | No | A |
| Pay By Link | Full redirect (LINK / MAIL / QR) | Fabrick page | No | A |
| Lightbox | Pop-up | Fabrick overlay page | No | A |
| Web Component | Embedded form | Secure Fabrick component (front-end) | No | A |
| API Only (Client) | Custom page | Front-end submit → Fabrick server | No (front-end only) | A-EP |
| API Only (Server) | Custom page | Merchant server → Fabrick server | Yes | D (PCI + AOC/ROC) |
| Plugin | Plug&Play on CMS | Depends on configuration | Depends on configuration | A / A-EP |