The verdict in three sentences
Securing a B2B payment portal rests on three pillars: a PCI-DSS compliant PSP (card data never touches your servers), 3-D Secure (strong authentication) and tokenization (no card stored in clear). Secure integration runs between 2,500,000 and 7,000,000 FCFA (~3,800-10,700 EUR) in 2026, with EU-compliant hosting and a retainer of 250,000-600,000 FCFA/month. The key contract point: clarify agency vs PSP responsibility; budget 5 to 9 weeks.
B2B payment security requirements
| Requirement | What it imposes | 2026 indicative cost (FCFA) |
|---|---|---|
| PSP-hosted card fields (SAQ-A) | No card storage on the portal | Included in integration |
| 3-D Secure / SCA | Strong buyer authentication | 0 - 900,000 |
| Tokenization | Encrypted reference instead of card | Included in PSP |
| TLS + HSTS encryption | Strict HTTPS, secure headers | 300,000 - 800,000 |
| EU-compliant hosting | Data in the EU, GDPR | 150,000 - 500,000 /year |
| Logging / audit trail | Track attempts and statuses | 400,000 - 1,200,000 |
| Security audit / pentest | Verify flows before prod | 800,000 - 2,500,000 |
The SAQ-A foundation (card fields hosted by the PSP) is the pragmatic choice: it keeps your portal outside the heavy PCI-DSS scope while guaranteeing card data security.
Responsibilities: agency vs PSP
| Responsibility | Agency (integrator) | PSP (Stripe/Adyen...) |
|---|---|---|
| Card data storage | Never | Yes (PCI-DSS certified) |
| Card form | PSP-hosted fields | Provides and secures |
| 3-D Secure / SCA | Triggered via API | Runs the authentication |
| Tokenization | Stores the token | Generates the token |
| Portal HTTPS / headers | Yes | N/A |
| Reconciliation / webhooks | Yes | Emits the events |
| Overall PCI compliance | SAQ-A (questionnaire) | Full certification |
The golden rule: the agency never sees a card number in clear. Any proposal that would store cards on the portal must be refused — it is a major legal and financial risk.
Mini case study
Mr. Barry, head of an import-distribution firm working with a nearshore setup, opens a B2B ordering portal. Target volume: 90 transactions/month, average basket 1,800,000 FCFA. Secure integration: 4,500,000 FCFA + 400,000 FCFA/month retainer + EU hosting 350,000 FCFA/year. Without 3-D Secure, a single fraud on a 1,800,000 FCFA basket (chargeback + lost goods) costs more than 4 months of retainer. With 3-D Secure and tokenization, the fraud rate falls under 0.1%, protecting an annual flow of ~1.94 billion FCFA (90 x 1,800,000 x 12) for a marginal extra cost. Security is not optional: it is insurance at 400,000 FCFA/month on all online revenue.
FAQ
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
What does a secure payment integration cost in 2026?
Between 2,500,000 and 7,000,000 FCFA depending on payment methods, security audit and hosting. Add 250,000-600,000 FCFA/month of maintenance.
Do I need to store my clients' cards?
No, never. With a PCI-DSS compliant PSP and hosted fields (SAQ-A), cards never touch your servers; you keep only an encrypted token.
Is 3-D Secure mandatory?
It is strongly recommended and often required by the card networks: it shifts fraud liability to the buyer's bank and sharply reduces chargebacks.
Where is the data hosted?
Preferably in the EU, on GDPR-compliant hosting, with encryption in transit and at rest. This also eases dealings with European clients.
Who is liable in case of fraud?
With SAQ-A + 3-D Secure, the PSP carries PCI compliance and authentication; the agency guarantees a secure portal (HTTPS, tokenization, logging). The contract must state this explicitly.
Let's scope your project. Specify your payment methods, monthly volume and compliance requirements: we price the secure integration and retainer in FCFA. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
