XeroWP
CARDZ3N Gateway for WooCommerce
CARDZ3N Gateway for WooCommerce

CARDZ3N Gateway for WooCommerce

0/5 (0 ratings) — active installs Updated Sep 19, 2026
ACHapple paycredit cardnmipayment gateway
Download v1.0.39 Plugin Website

CARDZ3N Gateway for WooCommerce turns your WooCommerce store into a full-featured embedded checkout powered by the CARDZ3N / NMI payment platform.

Buyers stay on your site — no visible redirect — and can choose between credit/debit cards, ACH bank payments, Apple Pay, Google Pay, or a saved payment method inside a single gateway UI. All sensitive payment data is tokenized in the browser by NMI’s Collect.js library, so card numbers and bank account numbers never touch your WordPress server.

B2B merchants benefit from automatic Level 2 and Level 3 commercial-card data — freight, tax, line-item, UPC, commodity code, PO number, and destination fields are populated from WooCommerce order data on every transaction.

Key features

  • Embedded, on-site checkout — no redirect
  • Credit / debit card, ACH / eCheck, Apple Pay, Google Pay — all in one gateway UI
  • Saved payment methods (card + ACH) with NMI Customer Vault
  • WooCommerce Subscriptions compatibility (if installed)
  • WooCommerce Pre-Orders compatibility (if installed)
  • Authorize-only + manual capture, void, full and partial refunds
  • Auto-capture on order-status change
  • 3-D Secure 2 / SCA
  • Dynamic descriptor with optional per-order suffix
  • Card-brand restrictions
  • Automatic Level 2 / Level 3 data pass-through
  • Optional checkout Purchase Order (PO) number field
  • Merchant-visible diagnostics in WooCommerce Status Logs

Privacy

This plugin processes payment data on behalf of the store owner. Here is exactly what it stores and what leaves your server:

Stored on your WordPress site (per order):

  • Card last 4 digits, brand, and expiry month/year — used to display saved methods and receipts.
  • NMI Customer Vault ID — an opaque reference (not the actual card or account number) used to charge saved methods.
  • NMI transaction ID, auth code, AVS/CVV response codes — used for refunds, reconciliation, and support.
  • For ACH: bank name and last 4 digits of the account number (never the routing number or full account number).

Never stored on your WordPress site:

  • Full Primary Account Number (PAN), full ACH account number, routing number, or CVV. These are tokenized by NMI Collect.js in the buyer’s browser before the form is submitted. Your server never receives them.
  • Your NMI Security Key is stored only in WordPress options and is never sent to the browser.

What is sent to external services:

  • To NMI Collect.js (browser-side): your public Tokenization Key, order total, buyer billing info as entered at checkout. Collect.js returns a one-time payment token.
  • To the NMI Transaction API (server-side): your Security Key, the payment token or vault ID, order amount, buyer billing/shipping address, line items, and Level 2/3 commercial-card fields when enabled.

Controller / processor relationship: The store owner is the data controller. CARDZ3N / NMI acts as the payment processor. Buyers should be informed via the store’s own privacy policy that card and ACH data is transmitted to NMI for processing.

Data retention on your WordPress site follows your WooCommerce order retention settings. To remove all plugin settings on uninstall, the plugin ships an uninstall.php that deletes its options automatically when deleted via Plugins Delete.

External services

This plugin connects to two external CARDZ3N / NMI services to process payments:

  1. CARDZ3N Collect.js (https://z3n.transactiongateway.com/token/Collect.js) — JavaScript library loaded in the buyer’s browser at checkout from the CARDZ3N gateway host (a white-labeled NMI instance). It securely tokenizes card / ACH / wallet payment details into a one-time payment_token. No sensitive data is sent to your WordPress server.

* Terms of service: https://www.nmi.com/terms/
* Privacy policy: https://www.nmi.com/privacy/

  1. CARDZ3N Transaction API (https://z3n.transactiongateway.com/api/transact.php) — server-side endpoint called by your WordPress site to execute charges, captures, voids, and refunds using the Collect.js token and your private Security Key. This is the white-labeled CARDZ3N gateway host; the plugin never calls secure.nmi.com.

* Terms of service: https://www.nmi.com/terms/
* Privacy policy: https://www.nmi.com/privacy/

Your private Security Key is stored in WooCommerce gateway settings and is only used server-to-server. Your public Tokenization Key is exposed to the browser (as designed by NMI) to drive Collect.js.

License

CARDZ3N Gateway for WooCommerce is licensed under the GNU General Public License v2.0 or later (GPL-2.0-or-later). The full license text ships with the plugin as LICENSE and is also available at https://www.gnu.org/licenses/gpl-2.0.html.

All PHP, JavaScript, CSS, and image assets bundled inside this plugin are first-party works authored by CARDZ3N and are released under the same GPLv2-or-later license. No third-party code or media libraries are redistributed inside the plugin package. The NMI Collect.js tokenization script is loaded at runtime from the payment processor’s own servers and is not included in this distribution.