> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kemycard.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance and security

> Your responsibilities as a partner, card data, PCI, the issuing entity and the security of your integration.

<AccordionGroup>
  <Accordion title="What am I responsible for?" defaultOpen>
    * The accuracy of the customer data you submit.
    * Never presenting the cards as anonymous, or as available without identity checks, in your product and your marketing.
    * The security of your API keys, of the data that goes through your servers and of your webhook endpoint.
  </Accordion>

  <Accordion title="Who verifies the identity of my customers?">
    KemyCard, through a hosted verification link returned by the API: a government-issued identity document with a liveness check, then a proof of address. You receive the result by webhook. See [KYC levels](/guides/kyc-levels), [KYC flow](/guides/kyc-flow) and [Proof of address](/guides/poa-flow).
  </Accordion>

  <Accordion title="Do I need a PCI certification?">
    We do not require one to integrate the API. The card number, expiry and CVV do pass through your server when you call [`GET /cards/{code}/sensitive`](/api-reference/cards/sensitive), so you remain responsible for their security:

    * call the endpoint only when your user displays the card;
    * never store or log the response.

    There is no hosted card display component at this stage.
  </Accordion>

  <Accordion title="Who issues the cards?">
    The issuing entity is not disclosed. Cards are issued through our authorized banking partners under Visa and Mastercard licenses. In the United States, KemyCard operates as a FinCEN-registered Money Services Business.
  </Accordion>

  <Accordion title="How do I protect my API keys?">
    Keep them on your server only. They work only from the IP addresses you declare in the dashboard. If a key leaks, revoke it from the dashboard and create a new one. See [API keys](/getting-started/api-keys).
  </Accordion>

  <Accordion title="How do I know a webhook really comes from KemyCard?">
    Each delivery is signed with HMAC-SHA256 with a secret specific to your endpoint. Verify the signature before processing the event. See [Webhooks](/guides/webhooks).
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.