Elavon

Overview

Elavon, a subsidiary of US Bancorp, is a major global payment processor serving merchants across retail, hospitality, healthcare, and e-commerce. When Elavon's scripts appear on merchant websites, they're powering the hosted payment form experience — secure card entry interfaces that process transactions through Elavon's PCI-compliant infrastructure without exposing sensitive card data to the merchant's servers.

Elavon's approach to web integration is conservative and security-focused, reflecting its banking heritage and the stringent requirements of payment card processing.

What This Script Does

Elavon's scripts handle secure payment processing on merchant checkout pages:

• Hosted payment form rendering: Displays card entry fields within Elavon's hosted environment (typically iframes), capturing card number, expiration date, and CVV directly on Elavon's PCI-certified servers
• Payment tokenization: Converts card details into secure tokens for transaction processing, allowing merchants to manage payments without directly handling card data
• Transaction processing: Submits payment authorization requests through Elavon's processing network and returns approval or decline responses to the checkout flow
• Session state management: Sets cookies to maintain the payment session, linking the customer's cart to the active transaction through the authorization cycle
• Fraud prevention signals: Collects basic device and session data to support fraud screening for the transaction
• 3D Secure support: Manages cardholder authentication flows when required by the card issuer or regional regulations

Consent & Compliance

Elavon's payment scripts operate in a clear compliance context:

• GDPR: Payment processing for a customer-initiated purchase falls under "performance of a contract" (Article 6(1)(b)). Elavon/US Bancorp acts as a data processor for transaction data and provides standard DPAs.
• ePrivacy Directive: Payment session cookies and fraud prevention data collection are strictly necessary for the requested service and exempt from consent requirements.
• PCI DSS: Elavon maintains PCI DSS Level 1 certification. Hosted payment forms keep card data within Elavon's certified environment, minimizing merchant PCI scope.

Should You Block This Without Consent?

Elavon's scripts are essential to completing purchases on your site. They process payment transactions that customers explicitly initiated by proceeding to checkout. The session cookies maintain transaction state, and the fraud prevention measures protect both parties. Blocking these scripts would prevent customers from paying.

No.