Live Demo: Try this and other plugins live — no installation, no risk: demo.markus-michalski.net
This page describes what the plugin does technically. It is not legal advice. You assess retention periods and information and deletion obligations for your shop yourself.
The plugin stores one record per mandate in the table mmd_sepa_mandate:
| Field | Content | Stored as |
|---|---|---|
| Customer | Customer UUID | Plain text |
| Mandate reference | Unique reference | Plain text |
| IBAN | The customer's bank account | encrypted |
| BIC | Optional, as entered | Plain text |
| Account holder | Name as entered | Plain text |
| Status | active, revoked or expired |
Plain text |
| Timestamps | Signed, revoked, created, updated | Plain text |
The plugin stores no other data, such as payment or credit information. It also sends no data to external services: the code contains no outgoing requests, and the PDF is generated locally with loading of remote resources disabled.
APP_SECRET of your Shopware installation. The plugin stores no key of its own.DE89****3000).If the
APP_SECRETchanges, already stored IBANs can no longer be decrypted. Mandate PDFs and the masked IBAN at checkout and in the customer account then fail with an error. There is no re-encryption function. Back up theAPP_SECRETand keep it unchanged when you move the shop. See also Troubleshooting.
deepLinkCode can download it. The response is delivered with Cache-Control: no-store.getDecryptedIban() returns the IBAN to code that calls the service, see Developer API.deepLinkCode (constant-time comparison). Failed attempts are logged with order ID, customer and IP address.validate-iban route is limited to 10 requests per minute per IP. A hash of the IP address is kept in the cache for that.revoked and a revocation timestamp. The plugin does not delete it.ON DELETE CASCADE).| Topic | Status |
|---|---|
| Collecting the direct debit | Not included. There is no export of a SEPA file (pain.008) and no bank connection. |
| Pre-notification | Not included. The plugin sends no e-mails to customers. |
| Mandate expiry | Not included. The plugin monitors no usage periods and never sets the status expired. |
| Chargebacks | Not included. The plugin knows no chargebacks and does not change the order's payment status. |
| Sequence type (first or recurring) | Not included. The PDF generally states "One-off payment / Recurring payments". |
What the plugin does provide: a unique mandate reference (unique across all mandates in the database), capturing the consent with a timestamp, validation of IBAN, BIC and account holder, the configurable mandate text, a mandate PDF, and revocation with a timestamp.