whats-best.ai
Search Sign in

Payment

Novalnet

EU-Made Report an error

Panel rating · 6 judges · How to read the stars

Category median

Sovereignty: 2 of 4 dimensions proven

0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.

by Novalnet AG · www.novalnet.de

Report an error on this page Is this your product? →

Read this page as one judge. Each weighs the same scores by what they care about.

The Finance Lead

Weighted verdict

Closes the month and owns the cash position. Wants payouts on a stated schedule, fees itemised per transaction rather than netted into a lump, reports that match the bank statement, and a rolling reserve written into the contract with a limit rather than discovered on a Tuesday.

Same scores as the panel view — this lens weights them the way this judge cares.

Scored by The Finance Lead

Payment methods & local coverage

How this is scored

Which methods a European customer can actually pay with — cards and wallets, SEPA Direct Debit, and the local methods that decide conversion per country — judged on the named list per market rather than on a method count.

0 — Cards only, or a method list with no statement of which countries and currencies each one covers.

3 — Major cards and wallets plus one or two European methods, with local coverage stated vaguely ("many local methods") and no SEPA Direct Debit.

5 — Cards, Apple Pay and Google Pay, SEPA Direct Debit, and the main local methods for DACH and Benelux (iDEAL or Wero, Bancontact, Klarna or invoice) listed by name with the countries they serve.

8 — Broad EU coverage named per country — including methods such as BLIK, TWINT, Przelewy24, EPS and Wero — multi-currency acceptance with settlement currencies stated, and which methods support refunds and recurring charges documented per method.

10 — Coverage is documented as a matrix a merchant can plan against: every method with its countries, currencies, refund, partial-capture and recurring support, and the provider's own acquiring versus third-party routing stated per method.

Report an error

The Finance Lead

The method list is genuinely per-country and named: SEPA Direct Debit, iDEAL|Wero for the Netherlands, TWINT and PostFinance for Switzerland, paydirekt for Germany, Multibanco for Portugal, alongside cards, Apple Pay, Google Pay and over 125 acceptance currencies with 25 payout currencies. What stops me planning against it as a matrix: I found no public information on refund support per method, recurring support is documented only for SEPA, PayPal, invoice and cards, and methods such as BLIK, Przelewy24 and EPS are not named. 2 6 7 9

Report an error

Checkout, SCA & fraud

How this is scored

The path from basket to authorised payment under PSD2: hosted and embedded checkout options, 3-D Secure and SCA exemption handling, fraud screening, and what the provider documents about keeping legitimate payments from failing.

0 — A single redirect page with no statement on 3-D Secure, SCA or fraud screening.

3 — Hosted checkout with 3-D Secure 2 mentioned, fraud screening as an unexplained add-on, and no word on exemptions or declined-payment handling.

5 — Hosted and embedded checkout options, 3-D Secure 2 with SCA handled by the provider, configurable fraud rules, and the resulting PCI DSS scope for each integration type stated.

8 — SCA exemptions (low value, transaction risk analysis, merchant-initiated) applied and documented, fraud tooling with rules and risk scores exposed to the merchant, network tokens or account updater, and liability shift explained per flow.

10 — Authorisation is engineered and shown: exemption strategy documented, soft-decline retry handled, authorisation-rate reporting by method and issuer country, and a checkout the merchant can run in their own domain while staying at the lowest PCI scope.

Report an error

The Finance Lead

Checkout comes in inline, overlay and redirect forms with branding and country-specific method display, hosted in a PCI DSS Level 1 environment that relieves the merchant of own PCI compliance, and the strongest SCA statement I found is an "SCA-kompatibel" badge next to a one-line "KI-basiertes Betrugsmanagement". I found no public information on 3-D Secure 2, exemption handling, configurable fraud rules, liability shift or authorisation-rate reporting, so the authorisation path is asserted rather than shown. 1 8 9 11

Report an error

Subscriptions & recurring payments

How this is scored

Charging the same customer again: card-on-file and merchant-initiated transactions, SEPA mandates, subscription logic and dunning — and whether the stored payment credentials can leave with the merchant.

0 — No stored payment methods; every charge needs the customer to pay again.

3 — Card-on-file tokens for repeat charges, but no SEPA mandate handling, no subscription logic, and failed-payment handling left entirely to the merchant.

5 — Stored cards and SEPA Direct Debit mandates, merchant-initiated transactions documented, and basic subscription plans with scheduled charges and failed-payment notifications.

8 — Subscription billing with trials, proration and plan changes, smart retries and dunning, card account updater, mandate management with pre-notification, and a documented process for exporting payment tokens to another provider.

10 — Recurring revenue is a first-class product: usage-based and invoice-based billing, dunning with measurable recovery, token migration in and out documented with a stated timeline and format, and recurring support stated for every local method that allows it.

Report an error

The Finance Lead

Subscription logic is real: an API taking interval, period and tariff parameters, predefined plans with trial periods, pause and cancel, intelligent retries on failed charges, dunning with automatic reminders, and an end-customer cancellation portal, with recurring documented for SEPA Direct Debit, PayPal, invoice and cards. I found no public information on SEPA mandate pre-notification, card account updater, proration, or any documented process for exporting stored tokens to another provider — and token portability is exactly what I need in writing. 9 10 11

Report an error

Settlement, reconciliation & API

How this is scored

Getting the money and knowing what it was: payout cadence and currencies, fee itemisation per transaction, reports that match a bank statement, and an API and webhooks a team can build finance processes on.

0 — Payouts on an unstated schedule, one net amount per payout, and no API or report beyond an on-screen list.

3 — A stated payout schedule and CSV exports, but fees netted invisibly into payouts and an API with thin documentation.

5 — Payout frequency and delay stated, per-transaction fee breakdown in reports, a documented REST API with webhooks and a test mode, and exports that link each payout to its transactions.

8 — Configurable payout schedules and settlement currencies, reconciliation reports that match bank lines, accounting integrations or exports named, a versioned API with idempotency and published rate limits, and a public status page with incident history.

10 — Finance can close the month from the provider's data: interchange and scheme fees itemised per transaction, automated reconciliation to the ledger, a deprecation policy for the API, and full historical data exportable after the contract ends.

Report an error

The Finance Lead

Payouts run on a stated and configurable cadence — 3-day, weekly, biweekly or monthly — in 25 currencies, with a choice between gross payout and separately billed fees or net deduction, and each payout carries a transaction-level settlement file itemising the cost positions; reports span reconciliation and chargeback statistics and export in CSV, XML, XLSX, JSON, SOAP, IDoc and MT940 on daily, weekly or monthly schedules into accounting software. What I could not find: any public word on webhooks, API versioning, idempotency, rate limits or a status page with incident history. 11 12 13

Report an error

Licence, risk & account terms

How this is scored

Who holds the merchant's money under which licence, and what the contract lets the provider do on a bad day: freezes, reserves, termination, chargebacks. Scored on what the terms and the imprint state, not on reputation.

0 — No regulated entity named; terms allow freezing funds and terminating the account at any time with no notice, reason or timeline.

3 — A licence mentioned without the entity, supervisor or register number, and terms that permit reserves and holds with no stated limits.

5 — The regulated entity named with its supervisor and licence type, safeguarding of merchant funds stated, chargeback fees and dispute process published, and a notice period for ordinary termination.

8 — Entity, supervisor, register number and passporting stated per country; reserve and rolling-hold conditions defined with limits and release timelines; freeze and termination terms with reasons and a route to appeal; PCI DSS level and attestation published.

10 — The bad day is written down: every regulated entity in the chain named with register links, reserve calculation disclosed, funds release timelines after termination committed, a documented complaint route to the supervisor, and exit terms that include handing back payment tokens and transaction history.

Report an error

The Finance Lead

The regulated chain is properly written down: Novalnet AG supervised by BaFin under the ZAG with register number 122702, the Handelsregister München entry, enumerated licences covering the full flow to payout, and merchant funds in insolvency-protected trust accounts under §13 ZAG a.F. and §17 ZAG n.F. with banks holding no set-off or lien rights, plus a published PCI DSS Level 1. For the bad day I found no public information on rolling-reserve conditions with limits and release timelines, termination notice periods, freeze reasons or an appeal route, and no chargeback fee figure. 4 9 13 14

Report an error

European sovereignty

How this is scored

Who the contracting and regulated entity is, and where transaction and cardholder data are processed and stored. Independently sourced by the sovereignty pipeline. The card schemes are US-based for every provider, so the scheme layer is not held against any one vendor; the part the vendor controls is.

0 — Non-EU contracting entity, no statement on where payment data is processed, and subprocessors unnamed.

3 — An EU licensed entity contracts, but payment and customer data is processed outside the EU by default without an explained safeguard, or the subprocessor list is absent.

5 — EU contracting and regulated entity, EU processing stated for core payment data, but the group parent or significant parts of the chain (fraud scoring, support, analytics) are non-EU without a stated safeguard.

8 — EU entity and EU licence, payment and cardholder data processed and stored in the EU on named infrastructure, subprocessor list published with locations, and a DPA covering the processing the provider does as processor versus as controller.

10 — Sovereign end to end and evidenced: European ownership, EU entity and licence, every processing location and subprocessor European, European rails (SEPA, Wero or national schemes) offered alongside cards, and certifications published.

Report an error

The Finance Lead

The contracting entity is the German, BaFin-licensed Novalnet AG and the data-centre page is unusually concrete — facilities exclusively in Germany, redundant infrastructure within Europe, all transaction and personal data processed only within the EU, and certifications from ISO 27001 IT-Grundschutz through ISAE 3402 Type II. But the imprint also lists affiliated entities in the UK, US and India, and I found no public information on ownership, a subprocessor list with locations, or a data processing agreement standing behind the marketing-level EU guarantee. 4 5 14

Report an error

Pricing transparency

How this is scored

Whether a merchant can compute the effective fee for their own mix of cards, countries and methods — including cross-border and currency conversion markups, chargebacks, refunds, payouts and monthly fees — from public pages alone.

0 — No public prices at all; every rate is a sales conversation.

3 — A headline percentage exists, but it is unclear which cards and countries it covers, and cross-border, currency conversion or chargeback fees are unstated — the effective fee is unknowable.

5 — Rates published per main method with domestic and international cards distinguished, but at least one commonly incurred cost (currency conversion markup, chargeback fee, payout or monthly fee) is missing or "on request".

8 — Every method priced publicly, cross-border and currency conversion markups stated, chargeback, refund and payout fees listed, minimum monthly fees and contract term given, and whether the model is blended or interchange++ said plainly.

10 — Complete fee computability: the effective rate derivable for a given volume, card mix and country mix — interchange++ with the markup published or a blended rate with every exception listed — plus volume tiers, reserves and every ancillary fee on a public page.

Report an error

The Finance Lead

Rates are published per method — SEPA at 0,24€ + 1,50%, iDEAL|Wero at 0,28€ + 0,30%, VISA and Mastercard at 0,24€ + 1,70%, non-EU and commercial cards at 0,24€ + 2,90% — with a 25€ monthly fee, a 99€ setup fee, no contract term, and a volume tier from 25.000 EUR monthly turnover with individual prices. I still cannot compute an effective fee from public pages: currency conversion markup, chargeback, refund and payout fees are not stated, PayPal's rate of 0,24€ + 0,00 depends on revenue and industry, and restricted-category prices are on request. 2 13

Report an error

European sovereignty — proven facts

2 of 4 dimensions proven

Built only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.

Ownership Not determined — uncited Report an error
Data residency EU only ⚠ unverified 3/3 pts 5 Report an error
Subprocessors Not determined — uncited Report an error

Where this could be wrong

What we left out

A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.

Do you know more about Novalnet? Tell us Report an error on this page

Sources (15)

The pages every claim on this page was read from — each one checked, dated, and kept verifiable.

  1. 1 Vendor homepage www.novalnet.de Checked 22 Sep 2026 Details →
  2. 2 Pricing page www.novalnet.de Checked 22 Sep 2026 Details →
  3. 3 Privacy policy www.novalnet.de Checked 22 Sep 2026 Details →
  4. 4 Legal notice www.novalnet.de Checked 22 Sep 2026 Details →
  5. 5 Security / trust page www.novalnet.de Checked 30 Sep 2026 Details →
  6. 6 Payment methods & local coverage — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →
  7. 7 Payment methods & local coverage — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →
  8. 8 Checkout, SCA & fraud — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →
  9. 9 Checkout, SCA & fraud — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →
  10. 10 Subscriptions & recurring payments — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →
  11. 11 Subscriptions & recurring payments — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →
  12. 12 Settlement, reconciliation & API — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →
  13. 13 Settlement, reconciliation & API — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →
  14. 14 Licence, risk & account terms — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →
  15. 15 Licence, risk & account terms — found from sitemap www.novalnet.de Checked 1 Oct 2026 Details →