SAM Registered
Vizient Contracted
Federal & State Contract Eligible
DUNS 968090816
CAGE 6H2R8
TX Dept. of Health License #1000751
SAM Registered · Vizient · DUNS 968090816 · CAGE 6H2R8
Vendor Assurance
How we protect payment data, buyer information, and order records.
This page is written for purchasing officers, contracting officers, and institutional buyers who need to document vendor security controls before issuing a purchase order. It states what we operate, who operates it on our behalf, and the scope of our responsibilities. Supporting documentation is available on request.
An overview of the controls described in the sections below for your vendor security review.
| Area | Position | Operated by |
|---|---|---|
| Card payment processing | Handled inside the BigCommerce checkout and passed to PCI DSS validated payment processors. Card numbers are tokenized by the processor. | BigCommerce and the payment processor |
| Card data storage | Card numbers entered at checkout reach the payment processor and are not written to MedEquip Depot servers or order records. Saved cards are held as processor tokens. | Payment processor |
| Cards outside the website | A secure payment link is the standard route, so the buyer enters the card directly into the processor. Card details are not retained in our order records, email, or files. | MedEquip Depot |
| Transport encryption | The storefront, the customer portal, and the checkout are served over HTTPS using current TLS. | BigCommerce and MedEquip Depot |
| Storefront hosting | Hosted on the BigCommerce SaaS platform, which holds Level 1 PCI DSS attestations as both merchant and service provider, along with SOC and ISO/IEC 27001 certifications. | BigCommerce |
| Buyer and order records | Held in our order management system and accounting system under role-based access, restricted to staff whose duties require it. | MedEquip Depot |
| Use of buyer data | Used to quote, fulfill, ship, invoice, and support the order, and to meet legal and tax obligations. We do not sell or license buyer data. | MedEquip Depot |
| Incident notification | Affected buyers are notified promptly, consistent with applicable state breach notification law including Texas Business and Commerce Code Chapter 521. | MedEquip Depot |
| Product supplied | Commercially available off-the-shelf medical equipment and supplies. We buy directly from manufacturers, national wholesalers, and other authorized distributors. | MedEquip Depot |
Online orders are paid inside the checkout of the BigCommerce platform that hosts medequipdepot.com. Card details are captured within that checkout and transmitted to a PCI DSS validated payment processor, which returns a token. Our staff and our internal systems work with the token and the transaction result.
The practical effect for your accounts payable review: a card number entered on our website reaches the payment processor, and it is not written to a MedEquip Depot server, database, or order record. A card saved for repeat ordering is held in the processor's vault, and what we hold is the token that points to it.
BigCommerce, the platform that operates our storefront and checkout, maintains Level 1 PCI DSS attestations of compliance as both a merchant and a service provider, the highest validation level defined by the standard.
MedEquip Depot is a merchant that relies on that validated environment rather than building its own cardholder data environment. We are glad to provide our current merchant self-assessment documentation to a buyer who requires it as part of a vendor file.
Purchase orders against approved credit are accepted from government agencies, schools, universities, hospitals, and corporate entities, which keeps card data out of the transaction entirely. Wire transfer and check are available at checkout, and ACH is available to approved accounts.
For an agency with a card-based purchasing program, the website checkout, PayPal, Google Pay, and Amazon Pay all keep the card inside the provider's environment.
Some orders start by phone or email rather than in the cart. Our standard route is a secure payment link, so the buyer enters the card directly into the payment processor.
Where a buyer provides a card another way, it is entered directly into the processor and is not retained in our order records, our email, or our files. We ask buyers not to send card numbers by email or fax, and a card that arrives that way is entered and the message deleted.
These steps help protect your account and payment information.
A purchase generates a limited and predictable set of business records. The table below lists all of them.
| Category | Examples | Purpose |
|---|---|---|
| Account and contact | Buyer name, agency or facility, business email, business phone, job function | Quoting, order confirmation, order status, and support |
| Order and shipping | Purchase order number, item numbers, quantities, billing and ship-to addresses, delivery instructions | Fulfillment, freight routing, and delivery confirmation |
| Transaction | Invoice records, payment method type, payment status, payment processor token | Invoicing, reconciliation, and accounting |
| Tax and compliance | Tax exemption certificates, resale certificates, prescriber documentation where a product requires it | Correct tax treatment and regulatory compliance on restricted items |
Buyer information supports the quote, the order, the shipment, the invoice, and the service that follows. It also supports our legal, tax, and record-retention obligations as a US business and as a registered federal vendor.
We do not sell or license buyer data.
Order, invoice, and tax records are retained for the periods required by tax, accounting, and government contracting rules, and for the audit and warranty support our buyers expect.
Account contacts, marketing preferences, and portal access are updated or removed on request. Write to govsales@medequipdepot.com and name the account and the change you want made.
Access to buyer records is role-based and limited to the personnel whose duties require it: quoting, order processing, fulfillment, accounting, and account management. Administrative access to the storefront, the order management system, and the accounting system is held by a small number of authorized users.
Credentials are individual to each person, and access is retired when a role changes or a person leaves.
We operate on established commercial platforms rather than custom infrastructure, and each provider carries its own security program.
A current provider list with the data each one handles is available to buyers who need it for a vendor file.
Should an incident affect buyer information we hold or a platform we rely on, our response follows a fixed order: contain and confirm with the affected provider, determine which records and which buyers are involved, notify those buyers with what we know and what we are doing, and report to the authorities the circumstances require.
Notification to affected buyers is made promptly and consistent with applicable state breach notification law, including Texas Business and Commerce Code Chapter 521, which governs a Texas-based business. Where a contract sets a shorter notification window, the contract governs and we will meet it.
To report a suspected security issue, a suspicious message appearing to come from MedEquip Depot, or unexpected activity on your account, write to govsales@medequipdepot.com or call 800-598-6960 Ext. 9. Include the account name and any order or quote reference so we can trace it quickly.
MedEquip Depot supplies commercially available off-the-shelf medical equipment and supplies. We buy directly from manufacturers, national wholesalers, and other authorized distributors.
Product documentation, including manufacturer instructions for use, registration and listing information, and country of origin, is available on request for the items on your solicitation or purchase order.
These controls cover the commercial sale, fulfillment, and support of catalog products. MedEquip Depot systems are not used to store classified information, and orders are placed and fulfilled without the need to transfer controlled unclassified information to us. Where a solicitation carries information security clauses that reach beyond this page, send them to govsales@medequipdepot.com and we will respond clause by clause before award.
MedEquip Depot works toward WCAG 2.1 Level AA as the standard for medequipdepot.com and the customer portal, the benchmark that Section 508 procurement reviews commonly apply. Accessibility improvements are in progress as part of an active site redesign. A buyer who needs a current accessibility conformance report for a solicitation should request it at govsales@medequipdepot.com, and we will provide our present status in writing.
A buyer who encounters a barrier on the site can order by email at orders@medequipdepot.com or by phone at 800-598-6960, and we will complete the transaction that way.
Send the list of what your review requires and the solicitation or purchase order reference.
This page describes the security practices of MedEquip Depot LLC, a Dallas, Texas medical equipment and supplies distributor, and the platforms it relies on. Certifications held by BigCommerce are stated as BigCommerce certifications. Related policies: Privacy Policy, Terms and Conditions, Shipping Policy, Government Purchases.
MedEquip Depot LLC · Security and Data Protection · Version 1.0 · Last reviewed September 2026 · Reviewed annually