← Terug naar Gids
Logo: OrsunPay

OrsunPay

OrsunPay gives merchants one API to route payments through their own payment service providers, with hosted checkout, payment links, refunds, and signed webhooks.

Gedeeltelijk gehost in de EU
payment orchestrationhosted checkoutpayment linkswebhooksfintechpspestonia
Bezoek WebsiteFeedback & correcties

OrsunPay is a payment orchestration platform from Orsun Tech OÜ in Tallinn, Estonia. Merchants connect their own payment service provider (PSP) accounts through one API and operational workspace, while the PSP continues to process and settle funds under the merchant's provider contracts.

The product targets teams that already hold (or are obtaining) PSP accounts and want a shared workflow for hosted checkout, payment links, refunds, and signed status webhooks. OrsunPay positions itself as software, not as a licensed acquirer or money holder: provider approval, methods, currencies, and settlement remain with each connected PSP.

Public documentation covers merchant API authentication, idempotent sale creation, HMAC-SHA256 webhook verification, and hosted card flows that keep PAN and CVV on the provider's page. Connector guides currently describe setups such as Adyen, Revolut Business, Stripe, Mollie, Checkout.com, Viva, and Comgate, with availability confirmed per account during setup.

EU-operatedBring-your-own PSPHosted checkoutSigned webhooksHosted SaaS

Shortlist OrsunPay when you need Estonian-operated orchestration software on top of your own PSP accounts, with hosted checkout, payment links, and signed webhooks. Skip it when you need the vendor itself to acquire or hold funds, when EU-only application hosting is mandatory (Railway USA is disclosed), or when you only need a single PSP native stack. Consider Stripe (or your primary PSP) alone if one provider already covers your methods and you do not need a multi-PSP control plane.

Key capabilities

Create and track sales through a common merchant API while keeping your own provider agreements and settlement. OrsunPay invoices a separate software fee; processing stays with the connected PSP. Method, currency, and market availability depend on each configured connection.

Redirect buyers to a localized hosted payment journey. Sensitive card details are entered on the PSP-hosted interface; docs state the merchant API rejects raw PAN/CVV. A browser return alone is not proof of payment: confirm verified status server-side.

Create amount-and-currency payment links via cabinet or API, share them, and deactivate when done. Opening a link is not a receipt. Cabinet link management is described as live-mode today; supported methods still follow your connected PSPs.

Status events are signed with a merchant-specific secret over the exact raw body bytes, with timestamp skew limits. Deliveries are at-least-once; docs require deduplication by event id. Live and test modes use separate endpoints and secrets.

Configure rules and priorities across your connections, inspect route decisions, and cascade eligible soft declines with safeguards for uncertain outcomes. OrsunPay does not promise lower fees or higher approval rates; results depend on your providers and traffic.

In één oogopslag

HQ
Tallinn, Estonia
Legal entity
Orsun Tech OÜ (17418287)
Product type
Payment orchestration SaaS (BYO PSP)
Self-hosted
No (hosted API and cabinet)
Open source
Not positioned as open-source platform
Commercial model
Software fees via merchant agreement; PSP charges separate

Best fit when

  • Merchants that already have (or will obtain) PSP accounts and want one API across connections
  • Teams needing hosted checkout or payment links without collecting card data on their own servers
  • Platforms that require HMAC-verified webhooks and idempotent sale creation before fulfilment
  • Operators evaluating multi-provider routing rules and controlled cascading on their own credentials

Poor fit when

  • Buyers seeking a licensed acquirer or wallet that processes and holds funds inside OrsunPay
  • Organisations that require verified EU-only application hosting with no US-group cloud or email subprocessors
  • Teams that only need one PSP's native Checkout and have no multi-provider orchestration requirement
  • Procurement that needs published ISO 27001 or SOC 2 evidence before shortlisting (none found publicly)

Consider instead when

  • When: You only need one mainstream card/APM stack and want the processor and orchestration in one vendor

    Consider: Stripe Checkout / Payment Intents (or your primary PSP alone)

    Fewer moving parts; you give up a dedicated multi-PSP orchestration layer.

  • When: You need a European licensed payment institution or acquirer rather than orchestration software

    Consider: Evaluate EU PSPs such as Mollie, Adyen, or local acquirers directly (not currently separate EuropeanStack entries)

    OrsunPay can still sit above merchant-owned PSP accounts once those exist.

  • When: EU-only hosting and subprocessors are a hard gate

    Consider: EU-hosted payment or orchestration vendors with published EU infrastructure

    OrsunPay discloses Railway (USA) hosting and US email storage for Resend when enabled.

Jurisdictie & eigendom

Juridische entiteit
Orsun Tech OÜ (registry code 17418287)
VS-moeder / zeggenschap
Geen bekende VS-moeder
CLOUD Act-blootstelling (indicatief)
Medium
Hosting / residentie
Domein / dienstRolOperatorStatusBewijs
orsunpay.com / merchant applicationsPrimary application and website hostingRailway Corporation (USA) · RailwayNiet-EUhttps://orsunpay.com/legal/sub-processors/ (2026-11-01 register)
Transactional emailEnquiry and transactional email when enabledResend (US storage)Niet-EUhttps://orsunpay.com/legal/sub-processors/
Website edge proxyCDN / security proxy where configuredCloudflareNiet-EUhttps://orsunpay.com/legal/sub-processors/

EU legal entity with no known US parent. Indicative CLOUD Act exposure is medium because core hosting and email paths name US-group providers. Card PAN/CVV are claimed to remain on PSP pages. Not legal advice.

Duurzaamheid

Niet gevonden

No public sustainability or renewable-energy datacentre page found on orsunpay.com as of research.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +4

Considerations & known limitations

  • MediumUS-group hosting and email subprocessors

    Supplier register names Railway (USA) for apps/website and Resend with US storage for email. Sovereignty questionnaires should treat application metadata and enquiry content as potentially US-accessible even though the legal entity is Estonian.

  • MediumLegal pages marked draft for review

    Terms, privacy, DPA, and sub-processors pages carry draft labels. Do not treat website legalese as the executed contract; require signed schedules and confirm deployment-specific suppliers.

  • MediumRecently registered operating company

    Orsun Tech OÜ entered the Estonian register on 21 January 2026 with EUR 1 capital. Limited public operating history; ask for customer references, uptime history, and support commitments in the order.

  • MediumNo public independent security audit or ISO/SOC

    Design claims (no card data on OrsunPay servers, encrypted credentials, signed webhooks) are first-party. No public audit report or ISO/SOC certificate was located.

  • LowCapability depends on connected PSPs

    Methods, refunds, cascading outcomes, and settlement timing follow each provider. OrsunPay does not promise fee reduction or approval-rate gains.

Open questions for due diligence

  • Which Railway regions and Cloudflare products are enabled for a given merchant deployment?
  • Will the executed DPA list the final authorised sub-processors and transfer mechanisms for production payment data?
  • Is a PCI responsibility matrix or AOC available under NDA for the orchestration layer?
  • Which connectors and refund rails are activated for this merchant's live account versus docs examples?
  • What contractual uptime, support response, and data-return commitments apply beyond the draft website terms?
Request vendor DPA / enterprise contact
Bezoek WebsiteCompare similar toolsView alternativesFeedback & correcties

Veelgestelde Vragen

No. Product and legal copy describe OrsunPay as payment orchestration software. Merchants keep PSP contracts; the connected provider processes and settles funds. OrsunPay charges a separate software fee under the merchant agreement.

Public docs include connector setup notes for hosted card flows with Adyen, Revolut Business, Stripe, Mollie, Checkout.com, Viva, Comgate, and a sandbox-oriented Colibrix path, plus categories covering APMs, wallets, pay-by-bank, and crypto invoices. A connector name is not an endorsement or a guarantee that every method is enabled for your account; confirm approval, methods, currencies, and geography during setup.

The published supplier register names Railway Corporation (USA) for application and website hosting, Resend (US storage) for transactional email when enabled, and Cloudflare where the website proxy path is configured. A B2B DPA template is published and becomes binding when incorporated into an accepted agreement with completed schedules. Legal pages are marked draft for review as of the dates on those pages.

Full and partial refunds are available through the API for eligible payments on connectors that support refunds when order and processing currencies match, subject to deployment activation. Webhooks cover transaction status plus refund succeeded/failed events, signed with HMAC-SHA256. Verify signatures before acting, and treat PENDING/PROCESSING refund states as incomplete.

No public claim positions the orchestration platform as open source or as a self-hosted product you operate yourself. Documentation describes a hosted merchant API and cabinet, with SDK clients for several languages. Confirm any on-prem or private-deployment options directly with the vendor if that is a hard requirement.