Payment flow explained
WP Companion provides a WooCommerce integration plugin. We are an independent software developer based in Trinidad and Tobago. This page sets out exactly what our plugin does, what it does not do, and where payments are actually processed.
WP Companion is not Scotiabank, and is not affiliated with or endorsed by Scotiabank. Payments are processed through the merchant's own Scotiabank eCom+ payment flow. WP Companion does not request or collect internet banking usernames or passwords, and never has.
The four roles
A WooCommerce checkout using our plugin involves four distinct parties. None is interchangeable with another. Understanding the separation is the clearest way to see that WP Companion is integration software, not a payment processor and not a bank.
01
A WooCommerce integration plugin that connects a merchant's online store to their Scotiabank eCom+ payment gateway. We are software developers. We do not move money, we do not hold funds, and we do not handle bank credentials.
02
Their own WooCommerce store, their own Scotiabank merchant account, and their own eCom+ gateway credentials issued directly by Scotiabank. The merchant is the business selling goods or services and the legal recipient of payment.
03
The eCom+ payment gateway that authorizes, captures and settles card transactions. Scotiabank operates the secure payment page where the cardholder enters card details, and controls all approval and settlement decisions.
04
The customer shops on the merchant's WooCommerce store, proceeds to checkout, and enters their card details into Scotiabank's secure eCom+ field. They are then returned to the merchant's store with confirmation of the transaction.
The payment journey
Every payment follows the same path. Card details never pass through WP Companion's software. Scotiabank's eCom+ flow handles all sensitive payment data directly with the customer.
They browse the merchant's WooCommerce store, add items to the cart and proceed to checkout. Everything so far happens on the merchant's own website.
The plugin passes the order amount, currency and reference to the Scotiabank eCom+ gateway using the merchant's own credentials. It then embeds Scotiabank's secure payment field in the checkout page. The plugin does not render the card field itself and cannot read what is typed into it.
The card details go directly from the customer's browser to Scotiabank's PCI-compliant platform. Scotiabank runs 3D Secure 2.0 authentication where required, checks the card with the issuer, and decides whether to approve the transaction. WP Companion has no part in that decision.
Scotiabank returns an approval or decline. Our plugin reads that result and updates the WooCommerce order accordingly. The money itself moves from the cardholder's issuer to the merchant's Scotiabank merchant account under the merchant's agreement with the bank, typically settling the next business day.
Plainly stated
What WP Companion does
What WP Companion never does
Security
Card data never reaches your server, but the paths around a payment still have to be defended. Version 2.6 added four changes to the payment callback and modal payment paths.
Callback verification
Signature checks now take the same amount of time whether they pass or fail, which closes off timing attacks that could otherwise be used to forge a valid callback.
Browser messaging
Messages passed between the payment modal and your checkout page are restricted to your own origin, so no third-party frame can listen in or inject a response.
REST endpoint
The modal payment endpoint requires a valid WordPress nonce, so a request has to originate from a real session on your store rather than being replayed from elsewhere.
Order integrity
A payment callback is checked against the order it claims to belong to before anything is written, so one customer's callback cannot be pointed at another customer's order.
None of these require any action on your part. They apply automatically once you update, which is a good reason to update sooner rather than later. Version 2.5 also fixed a case where an empty pre-response from Scotiabank could be treated as a completed payment, which sent some customers two order confirmation emails for a single purchase.
We would rather explain it properly than have you guess. Ask us anything about the flow, the bank relationship or what the plugin can see.
