CorvusPay WooCommerce Payment Gateway

The transaction flow through the CorvusPay system goes like this:

1. a buyer in the web shop selects a product or a service he or she wants to pay for with a card.
2. the buyer is redirected from the merchant’s site to the CorvusPay payment form (site) where he or she enters the data necessary for the completion of the card transaction.
3. CorvusPay sends an authorisation request to the bank.
4. the bank sends a response to the authorisation request submitted by CorvusPay.
5. CorvusPay redirects the buyer to either the ‘cancel’ or the ‘success’ url defined by the merchant, depending on the transaction outcome.

In accordance with instructions from Corvus, merchants themselves set up their test and production accounts in the CorvusPay merchant interface through which they have an insight into the information about each transaction. CorvusPay also offers the option of integrating transaction management into the merchant application business logic (CRM, CMS) via API mode.

All major payment card brands are supported in CorvusPay: American Express, Diners, Discover, Maestro, MasterCard and Visa.

Payment in web shops, when accepted through Croatian banks, is only available in the local currency, i.e. in HRK. Payment in web shops, when accepted through banks from Bosnia and Herzegovina and Serbia, is only possible in domicile currencies, i.e. in BAM (the Bosnian and Herzegovinian market) and RSD (the Serbian market). To provide processing services for transactions in other foreign currencies (possible only for companies registered in the European Union) CorvusPay is affiliated with Wirecard.

Instalment payments are possible through CorvusPay only by cards issued by certain Croatian banks. Contact us for details.

Authorisation is a type of transaction that does not require additional confirmation from the merchant for debiting the buyer's card, as it is performed in real time. Preauthorisation is a type of transaction through which the funds on the buyer’s card are reserved, but are not released until the merchant confirms (completes) the transaction. It is used in case the merchant needs to check whether the ordered goods are in stock. The deadline for the preauthorisation completion depends on the bank that issued the card. Once the preauthorisation expires, payment collection is not possible anymore, and the buyer must go through the payment process again. It is recommended that transactions be completed within 7 days.

CorvusPay allows card data storage, which enables the implementation of advanced functionalities, such as:

• Tokenization: the buyer saves their card data, so the merchant can initiate the transaction at a later time,
• CorvusWallet: the buyer saves their card data, and can pay with their stored cards in all web shops that support CorvusWallet as a payment method.

The SSL certificate is a piece of web server-side code that enables secure exchange of information between the website visitors and the server where the site is located, and contributes to the overall user confidence in the web address and the merchant's website. When the web browser displays web pages, the SSL certificate provides encrypted connection to the server. Thanks to the SSL certificate, personal data and buyer messages remain protected. In addition to online security, SSL certificates also provide added confidence to buyers because they contain information that confirms the validity of the company. Since the buyer enters all sensitive card data into the CorvusPay payment form, which is ensured by a high level of SSL encryption (256-bit encryption), the merchant does not come into contact with card data, is not responsible for its transfer or storage, so he or she is not required to have an SSL certificate. Additionally, all stored user data is protected by strong cryptography, using a FIPS 140-2 Level 3 certified cryptographic device. SSL is, however, recommended to web shops, as some Internet browsers display a warning message to buyers the moment they switch from a page secured by an SSL certificate (exposed through https: //) to a page that is not secured. Although harmless, an alert message that appears when a buyer, having entered sensitive card data into the CorvusPay payment form, returns to the merchant's online point of sale, can often be confusing and does not instill trust, which is why we recommend our clients to install an SSL certificate. If the sole purpose of having an SSL certificate is to disable the above mentioned warning message, a certificate with a minimum verification level is sufficient.

CorvusPay is neither a bank nor a company offering banking services, meaning that it neither has access to buyer accounts nor does it transfer money from accounts. Payment terms and due dates are to be negotiated directly with the bank / card scheme, and they usually depend on the card brand used in the transaction.

According to the Cash Transaction Fiscalization Law, cards are a payment method which falls within the scope of cash payments, which means they are subject to fiscalization. Corvus does not offer an invoice fiscalization solution at the moment.