Compliance · Global
PCI DSS
PCI DSS sets the security requirements for handling card data. Often the simplest approach is to keep card data away from most of your system in the first place. We help you scope your payment flows, shrink that scope, secure what remains and prepare evidence for the assessor.
Who it applies to
Is this law relevant to you?
Any business that stores, processes or transmits payment card data, and service providers who can affect how secure it is.
Core obligations
What the law asks of you
A plain language summary. Your legal team should confirm how each point applies to your business.
- Scope reduction
- Tokenisation and hosted payment pages, so fewer systems are in scope.
- Network security
- Network segmentation and firewall controls.
- Data protection
- Card data encrypted when stored and when sent.
- Vulnerability management
- Regular patching, scanning and secure coding.
- Access control
- Access only where needed, with strong authentication.
- Monitoring and testing
- Logging, log reviews and regular penetration tests.
How we help
From gap to evidence
- Scope review and a plan to reduce it
- Secure design for payment integrations
- Penetration testing and scanning
- Policies and evidence for the assessor
- Support during the QSA assessment
We use Razorpay or Stripe. Do we still need PCI DSS?
Usually yes, though the scope is much smaller and is often covered by a self assessment questionnaire. We help you confirm which one applies.
Request a PCI DSS assessment
Regulations
Other laws we advise on
Start a conversation
Compliance that holds up in practice.
Start with a short assessment. We tell you which laws apply, what to fix first and what it will take.
A specialist replies within one working day. The first conversation is free.